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ABSTKACT 


The purpose of this study was to provide designs and data to aid in the' 
selection of aerodynamic surface control and thrust vector control servo- 
actuators during the final definition phase of the space shuttle. The 
studjf consisted of four basic activities: establishment of requirements, 
industry survey, conceptual designs, and trade-off evaluation. Point 
design configurations were established for the flight control applications 
that had the greatest impact on vehicle interfaces. Parametric weight 
data was developed to provide trend information for those applications 
not specifically configured. The design configurations were to employ 
any type of power and control that represent current state-of-the-art 
technology. This included hydraulic , mechanical, electromechanical, 
and gas servoactuator development. Additionally , the trade off included 
a digital configuration for comparison to the conventional analog type. 

The parameters used in the comparison evaluation were ~ weight, re- 
liability, maintainability, checkout capability and cost. Weight was 
developed in quantitative form. The remainder of the parameters were 
in qualitative form to provide relative comparisons of the point designs. 
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SUMMARY 


The objectives of this stady were to survey the state of the art of flight control servo- 
actuators, produce conceptual desiars for space shuttle applications, and provi.de 
basic information to assist in servoactuator selection during the final definition phase 
of the space shuttle program. 

The study was divided into four basic activities; (1) establishment of requirements 
;md ground rules for the flight control subsystems , (2) industry survey of current 
state of the art, (3) conceptual design and point design configurations for various flight 
control applications, and (4) trade-off evaluation. 


The principal subject of the study was redundancy mechanization. Failure criteria 
rather than reliability goals were established as a requirement. The' basic failure 
criteria requirement was fail operate, fail safe for aerodynamic flight controls and 
thrust vector controls. With respect to each subsystem this criteria established 
redundancj' as follows: 

a. Aerod 30 iamic surface controls — fail operate; fail operate, de^aded performance 
(booster and orbiter). 

b. Thrust vector controls (TVC) /engine (orbiter) — fail operate, fail to null. 

c. Thrust vector controls/engine Rooster — fail to null. 

The industry survey included review and analysis of hydraulic , mechanical , electro- 
mechanical, gas, and digital development. Nearly all the effort and advances in the 
development of fly-by-\vire multiple channel/system servoactuator s has been on ana- 
log hydraulic servoactuators. Development work has been conducted in the other dis- 
ciplines but not of sufficient magnitude to consider them equal to the state of the art of 
hydraulic servoactuators. An annotated bibliography report GDC-DC70-013 containing 
110 references was submitted to NASA-hffiC at the conclusion of the survey. 


Tlu'ee point designs were established for each of the following applications: 


a, 

b. 

e. 

d. 


V. 


Booster elevator (largest load application on booster). ' 
Orbiter elevator (largest load application on orbiter). 
Orbiter aileron (smallest load application). 


Orbiter TVC. 
Booster TVC. 
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All configurations except one were either analog electrobydraulic or analog electro- 
mechanical upper servo stages controlling hydraulic power to linear hydraulic actuators . 
One configuration for the orbiter aileron was an analog electromechanical using spring 
clutch servos to engage electrical power to a ballscrew output. In addition, one digital 
electrobydraulic configuration was created for comparison to the aerod 5 Tiamic surface 
control analog configurations. 

Some of the prominent trends ajid results are as follov/s: 

a. The electromechanical configuration was heavier and contained less output redun- 
dancy than the hydraulic configurations for the orbiter aileron. It would have to 
be in a stronger competitive position to be considered further because commonalitry’^ 
would dictate that it be used on other applications, 

b. The digital configuration compared favorably with respect to weight and reliability 
on the small load application, but became heavier for large load applications due 
to the penalties involved in providing large digitizer pistons. The digital concept 
was new and did not represent anything existing that has had the benefit of some 
development. As such there remains some doubt concerning its functional and 
performance capabilities. 

c. On the largest load application (booster elevator), a four-channel, four-power 
actuator configuration/side weighs approximately 20% less (over 2000 lb total 
vehicle weight impact) than a four-channel, three-power actuator configm’ation. 

- This weight difference is the result of failure criteria requirements. A three- 
power circuit/actuator arrangement can collectively produce 300% of required 
hinge moment (100% after t\vo failures) whereas a, four -power circuit/actuator 
• arrangement can produce only 200% of required Mnge moment normally to guar- 
antee 100% capability after two failures. The increased weight totals for the 
three-power circuits are due to increased weights of actuators, transmission, 
power source, fuel, and hj^draulic power generation over that of four power 
circuits. 

d. Considering only actuators and hydraulic transmission for intermediate load ap- 
plications (booster rudder and aileron, orbiter rudder), four actuators weigh 
less than three for loads down to approximately 10,000 ft-Lb. The weight dif- 
ferences become small, however, and future cost effective analysis must deter- 
mine the weight versus complexity cross over point. 

e. In a four-power circuit/actuator configuration, for the large load applications, 
reducing the actuators by two and inserting switching valves obviously reduces 
the overall weight. However, to go one step further and reduce the power circuits 
by two gains little or nothing because the actuators must then double in hinge 
moment capability. This is based on a ground rule of no castrastropMc actuator 
failures for either case and only one power circuit failure for the latter case. 
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f . Self-monitoring mechanization of servo channels whether thesi^ be force summing 
or active/standby appears to result in higher reliability. The self-monitoring 

' detection and switching for each channel is in parallel mth all other channels 
whereas cross monitoring, which depends on cross coimections of some form, 
is not. The reliabilitj'^ models used in this study were sensitive to the parallel 
versus series arrangement of detection and switching elements. 

g. Weight and ease of installation can be improved for TVC servoactuators by reduc- 
ing redundancy of power actuators and applying the failure criteria to only the 
servo control portion. TMs is reasonable due to the short operating time per 
flight. 

h. Reducing the power actuator redundancj*' as mentioned in g, a servoactuator com- 

mon to orbiter and booster and operating off vehicle APU power -has considerable 
appeal. The lowered redundancy at the output makes the booster configuration 
(22 servoactuators) more palatable and separate engine-driven hydraulic circuits 
can be eliminated. . ’ ' - 

i. TVC servoactuators should employ mechanical feedback so that automatic center- 
ing (fail to null) is achieved after failure. 

j. For aerodynamic surface controls, force summing mechanization of control 
chaimels using self-monitoring teclmiques is easily adaptable to manual detection 
and correction by the flight crew. 

k. An electromechanical, four-control chamiel mechanization is versatile in that 
one basic unit can be used to control any combination of hydraulic circuits and 
output actuators. 
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SECTION 1 


INTRODUCTION 

Studies on reusable vehicles for space applications have been conducted for a decade . 
Parametric studies over this period have derived a concept called the space shuttle. 

This concept can be classified as a vehicle that combines the technology of missiles 
and aircraft. Aircraft flight control systems during this era have also been evolving 
towards "flj'^-by-wire , " where control mechanization is electrical rather than mechani- 
cal. Larger and higher performance aircraft, smwivabiliiy, .and better tactical weapons 
delivery are primary reasons for the need to advaxice the state of the art of flight con- 
trols. However, until that time when the confidence and reliability of electrical, control • 
can match mechanical control, fly-by-wire systems will employ multiple channels 
(systems) to a more redundant level. A major part of the fly-by-wire development has 
dealt with redundancy mechanization of servoactuators. 

The space shuttle application adds a new burden to the development of fly-by-wire 
servoactuators ; space and re-entry environment. 

The objectives of this study are to produce conceptual designs of servoactuators suit- 
able for use on the space shuttle with supporting data that will provide the basic infor- 
mation for servoactuator selection during the final definition phase of the space shuttle . 

The approach used was to establish point designs based on. two criteria: vehicle require- 
ments as known at the start of this study and current state-of-the-art technology. The 
technology includes the use of electrical, mechanical, and gas power as well as hydrau- 
lics . Additionally, the study includes evaluation of a digital servoactuator versus the 
conventional analog servoactuator . 

A primary objective of any design is to achieve the desired reliability with the minimum 
number of parts. As such, redundancy is a means whereby the desired reliability is 
achieved. Ideall 3 ^, a servoactuator would consist of a single functional path of 100% 
reliability. Since this is not possible, the next logical step would be to add redundancy 
only as required until reliability goals are met. This procedure assumes that relia- 
bility goals are Icnown, can be properly apportioned, and failure rate data is accurate. 
Unfortunately, failure rate data for nonelectronic components is subject to error. 

The principal subject of this study is the application of redundancy mechanization tech- 
niques in servoactuators applicable to the space shuttle . To accomplish this purpose 
and also to eliminate dependency on absolute reliabilit 3 '^ numbers, the requirements are 
stated in terms of failxures permitted for mission success and/or mission safety (e.g. , 
fail operate, fail safe). This approach is conservative and generalty defines the limit 
of complexity required. 
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This introduction is Section 1 of this report. Section 2 covers the industry survey, 
separate annotated bibliography report, GDC-DCB70-013, includes references xised 
herein and a glossary of terms commonly used in redundancy mechanization discussions. 
Section 3 includes a vehicle baseline description, servoactuator requirements , and 
ground rules and assumptions needed to establish point designs. Section 4 is a discus- 
sion on various techniques used in servoactuator development and lists the candidate 
point designs and rationale for selection. Section 5 displays the failure modes and 
effects analysis of each design. The FMEA is a backcheck on adequacy of design to 
meet failure criteria requirements and an expose' of weak elements within a design. 
Section 6 establishes the basic parameters and data used for tradeoff evaluation. 

Section 7 covers the tradeoff evaluation. Section 8 includes the conclusions and 
recommendations . 
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SECTION 2 


INDUSTRY SURVEY 


2.1 GENERAL 

As a part of the industry survey, approximately 45 letters were sent to 36 companies. 
Follow-up telephone conversations and letters were made primarily to those companies 
that responded to the original survey letters. Activity in this regard included many 
personal contacts with representatives of the responding companies. In addition the 
Defense Documentation Center, Alexandria, Va. , and the NASA linear tape were con- 
tacted for data retrieval. The time period covered was mainly 1960 to 1970. 

The survey yielded approximately 150 documents of which 110 are included in the anno- 
tated bibliography, report number GDC-DCB70-013. The documents may be broken 
down as follows : 


Government-sponsored reports 22 

Technical papers and articles 29 

Industry-sponsored reports 38 

Miscellaneous 21 


Information gathered is not exclusively on "multiple fault correcting" servoactuator 
development. It also includes general design data that helped form parametric data 
used in the evaluation. 

2,2 STATE OF THE ART 

2.2.1 GENERAL . Hydraulics dominate the scene not only in power control but also 
in application of redundancy mechanization techniques. Of the 110 documents described 
in Section 2.1, approximately 75% were concerned with the application of hydraulics. 
Development of redundancy mechanization is almost solely a hydraulic venture. The 
reason for hydraulic technology dominance is rather obvious; much of the recent de- 
velopment efforts have been based on conversion of existing aircraft flight control 
systems to fly-by-wire, where a configuration was already in existence employing 
hydraulic power. 

"Redundancy mechanization" is a term used herein that describes special techniques 
used in implementing fly-by -wire control. For many reasons (survivability, better 
weapons delivery, increased manual control complexity, increased structure life, etc.) 
flight control systems are evolving towards fly-by-wire . A larger burden is placed on 
the servoactuator to accomplish more functions. As electrical command replaces 
mechanical command, redundancy is increased to offset the loss of inherent reliability 
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of a manual control system. In a pure fl 5 >'“by-\v'ire system it is logical to combine the 
electrical command conversion devices with the power control actuator. This total 
package is termed the servoactuator. Therefore, within the development of fly -by- 
wire control, the servoactuator must accept multiple electrical command signals in 
addition to multiple power systems and produce a proper output. Due to anticipated 
failures and fast reaction time required, the servoactuator usuall 3 J- must also incor- 
porate logic to accomplish automatic fault correction. The techniques used to accom- 
plish this staggering task is therefore called redundancy mechanization. The following 
paragraphs briefly outline some of the development effort that has been accomplished 
or is in progress. 

2.2.2 HYDRAULIC APPLICATIONS. Many programs have been sponsored by the 
Air Force Flight D 5 mamics Laboratory (AFFDL). A triple redundant- actuatoi' was 
developed by Weston Hydraulics for a program conducted by Sperry.^* 2* The unit 
used. "force summing" of the three active command inputs with an electronic model to 
give two fail operate capability. Hydraulic Research developed aquad redundant servo- 
actuator that was installed and flown in a B-47, accumulating approximately 18 flight 
hoturs in flji'-by-wire mode.^**^ The actuator was an active /standby arrangement using 
hydraulic logic for fault detection and liad two fail operate capability'. 

Hydraulic Research also built a servoactuator for the TWEAD program.^ This actuator 
is installed on an F4C. The control package is fail operate, fail safe and performs as 
a series servo in conjunction with manual control. Bertea built a fail operate actuator 
that employs a hydro-mechanical force summing technique called mid value logic for 
Douglas as a part of a program to evaluate a redundant fly-by-wire system. ^ The 680J 
program in quest of survivability as well as fly-by -wire has been responsible for con- 
tinuing development. LTV electrosystems built a duplex integrated package that in- 
corporated .two hydraulic power supplies with the servoactuator. The four control 
channels in this unit use electromechanical rather than the conventional electrohydrau- 
lic signal conversion techniques,® The four electromechanical actuators are force 
summed. LTV is now developing an electromechanical signal conversion control that 
uses servo motors and differentials in a velocity summing arrangement. In each case 
the outputs from the control portion operate conventional hydraulic power spools and 
actuators. In addition to the many development programs that resulted in hardw'are 
either for ground (non flight rated) or flight test, AFFDL has sponsored several studies 
that did not carry through to the hardware stage but are definite contributions to the 
fly-by-wire development. 

The SST is another activily that has contributed to servoactuator development. Bertea 
is now working on a quadruple system for the horizontal tail, The configuration has 
four hydraulic power systems and four electrical command inputs that sum with mechani 
cal inputs from the pilot. The configuration is not purely fly-by-wire but electrical 
command redundancy is quadruple because electrical control is considered mandatory 
for safe flight. 


^Numbers represent references at the end of the report. 
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Moog developed a triple redundant servoactuator for the Saturn S-IVB stage . ^ The 
redundancy in this case is limited to the servo channels . Detection-correction is not 
used in the unit. Fault correction consists of a failure in a control channel being over- 
ridden by the two good channels. The failed channel is not de-activated. The actuator 
provides fail operate capability and can tolerate many combinations of dual faults . 

Moog refers to this design as a majority voting servoactuator. 

The programs and hardware listed aboye are by no means the total effort tliat has been 
pursued in the development of hydraulic servoactuators , but do. represent some of the 
more prominent efforts . 

Electronic models have been used as a substitute for an electrohydraulic servo channel 
to provide intelligence for comparison of sigiials. This was quite often necessary in 
an aircraft equipped with two hydraulic systems but requiring fail operate capability 
in the servo control portion., Fail operate normally requires a minimum of three 
signals for comparison. There seems to be some disagreement as to the effectiveness 
of using electronic models. Electrohydraulic servos have been modeled; however, 
there has been difficulty in simulating wear, temperature effects, and fluctuating load 
of an electrohydraulic servo valve. 

2.2.3 MECHANICAL/ELECTROMECHANICAL APPLICATIONS. Mechanical and 
electi'omechanical are grouped together because of their similarity. The servoactuator 
or actuating device is essentially the same in either system. The major difference is 
in power transmission. A pure mechanical system uses mechanical shafting from the 
power source to the servoactuator. An electromechaiiical system uses electrical power 
transmission and electric motors at the servo. 

The development of electromechanical servoactuators for primary flight controls and 
specifically fly-by-wire flight controls is not as advanced as its hydraulic counterpart. 
Development has been progressing but practically no hardware testing has been accom- 
plished on multiple system servoactuators for large load applications. The primary 
advantages an electromechanical system has over hydraulics is long term storage at 
cold tempei'afure , elemination of fluids and seals , and adaptability to environmental 
extremes. 

Curtiss Wright designed and built an all -mechanical aileron control system for the 
North American F-lOO simulator. ® Mechanical shafting delivered power from the 
power source to the servo clutch. A torroidal clutch was used to clutch in power on 
command to power hinge actuators located at the aileron. This system was "flown" on 
the simulator for evaluation. The conclusions were that the mechanical system servo 
performance capabilities compared favorably with those of a hydraulic servoactuator.^^ 
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There have been many electromechanical servo applications primarily for small power 
applications. Examples of ttiese applications are: 


Marc Condor missile steering: 

Mark 37 torpedo fin control: 

QH-50C helicopter; 

Sergeant missile: 

KC-135 — horizontal stab, 
manual trim: 

Apollo service module — 
engine giinballing: 


Spring clutch servo 
Magnetic clutch servo 
Magnetic clutch servo 
Magnetic clutch servo 
Magnetic clutch servo 

Magnetic clutch servo 


None of these applications would classify as automatic -fault-correcting servoactuators 
although the Apollo system has a redundant power supply, command, and servo clutch 
arrangement that can be switched in manually. 


2.2.3. 1 Servo Clutch . The heart of the electromechanical servoactuator is the servo 
clutch. Figure 2-1 is a simplified schematic of an eiectromechanical arrangement. 
The servo clutch is analogous to the electrohydraulic servo and power spool in a hy- 
draulic system. The thi*ee basic t 3 Tpes that have been used in servo applications are 
the torroidal clutch, spring clutch, and magnetic clutch. 


COMMAND 



LOAD 


POWER SOURCE 
& GEARING 


Figure 2-1. Electromechanical System 

The torroidal clutch has a continuous rotating input shaft, variable rollers , center 
torroid, and differential rollers attached to the output shaft. See Figure 2-2. In the 
position shown there is no rotation of the output shaft, A command input changes the 
angle of the variable rollers which in turn causes the center torroid to change speed 
with respect to the input shaft. This causes rotation of the differential rollers and 
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Figure 2-2. Torroidal Clutch 

output shaft. The unit is bi-directional and has good resolution. Disadvantages of this 
device are the requirement for a lubrication sump, high heat generation, »and high 
force inputs for large step inputs due to the gyro effect. 

The spring clutch consists of an input shaft, spring energizer, two springs to give bi- 
directional output, an output shaft, and brake as shown in Figure 2-3 (only one spring 
assembly is shown) . The spring clutch is by nature an on-off device . When on , the 
clutch transmits power at full rate . Problem areas for this device include lowered 
response as size increases (spring inertia), dead zone (spring engage meiit motion), 
and high threshold (there must be positive clutch engagement). It is attractive in that 
there is no appreciable heat generation. To eliminate the first two' problems the unit 
can be designed such that the spring rotates with the input shaft and clearances reduced 
so that spring engagement travel is minimized. This, however, eliminates the brake 
from the design which in effect disconnects the output from ground when there is no 
error signal. 

♦ 

An example of the magnetic clutch is shown in Figure 2-4. When the clutch coil is 
energized, the magnetic field is produced, crosses the powder gap, and causes radial 
alignment of the iron particles in the gap forming chains across the gap. These 
chains couple input to the output (drive disc) where the output torque is proportional to 
input current. This type clutchhas been applied successfully, as mentioned before, for 


2-5 




Figure 2-3. Spring Clutch 



Figure 2-4. Magnetic Particle Clutch 
2-6 


small power applications. However as size increases- response lowers as seen by 
observing Figure 2-5. Also there are problems in repeatability where experience has 
shown that due to shearing' action the magnetic particles start to lose their effective- 
ness and the output torque versus input current relationship changes after repeated 
cycling. The clutch would suffer severe heating problems unless a brake is used when 
applied to control of aerodynamic surfaces because the clutch absorbs power when 
holding against an external load. 

2. 2. 3, 2 Harmonic Drives. A harmonic drive is basically a gear reduction device. 
However, there is some development effort to adapt this technique to servo control. 

In addition to describing 20 operational applications of harmonic drives, Reference 11 
describes a potential electromagnetic servo solution. Figure 2-6 is a schematized 
version of the device. "A series of electromagnets are positioned about the flexspline, 
and are progress iveij^ excited to produce a rotating field vector which serves to radially 
deflect the low inertia flexspline. Mechanical rotation occurs only at the lov/ speed 
circular spline and output shaft. This type of structure appears capable of very high 
acceleration rates well in excess of those obtainable with state-of-the-art electrome- 
chanical drives and servoactuators . "ff 

2.2,4 GAS APPLICATIONS. Some development work. has been accomplished on 
pneumatic servoactuators but ver5'' little hardware is in existence. Bendix conducted 
a study for the Air Force Flight Dynamics laboratory evaluating the feasibility of 



.5 1.0 10 100 . .-500 

FREQUENCY - CPS 


Figure 2-5. Typical Frequency Response Curves — Magnetic Clutch 
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Figure 2-6. Electromagnetic Harmonic Drive 

applying the Bendix Djmavector* actuator {operating on 50 psig compressor bleed air) 
to actuate flight control surfaces, A pneumatic servoactuator was built and tested 
by Parker -Hannifin under contract to NASA-MSFC. The unit was designed to use 
-250® F hydrogen gas. Westoir built and tested a pneumatic digital servoactuator under 
contract to NASA-MSFC. This unit was also designed to use -250"F hydrogen gas. 

The work on pneumatic development has been essentailly to advance the state-of-the- 
art of pneumatic servos to the level that hydraulics reached nearly 20 years ago. As 
such there is no specific correlation between pneumatic servo development and fly-by- 
wire development. 

2.2.5 DIGITAL APPLICATIONS . Most of the development effort on digital servo 
actuators has been in the field of hydraulics. The industry survey did not disclose any 
effort conducted on multiple channel servoactuator s. 


^Trademark of the Bendix Corporation 
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There is very little operational hardware in. existence. The Convair 990 commercial 
jet uses a digital open loop arrangement for low rate trim of the horizontal stabilizer. 
There have been feasibility studies and breadboard models tested of single channel 
digital servos. 

Digital servoactuators fall into two broad categories and are classified in relation to 
the input signal characteristics. 

a. Incremental ~ Tlie input signal is in the form of a series of pulses some- 

times referred to as a pulse train. In this case a hydraulic 
control unit might consist of a single valve, digital pump, 
and associated sequencing and polarity valves as shown in 
block form. Figure 2-7. 

b. Parallel -binary — The input signal is in the form of parallel or simultaneous 

signals to multiple coils of a valve or to multiple valves. 

An example of a multiple coil valve is shown in Figure 2-8. 
Each coil produces twice the output of the adjacent coil. 

The smallest coil is sized to produce the smallest incre- 
mental change required. Thus, the valve can receive one 
or more pulses in the same lime interval and produce an 
output proportioned to digital input. The digital/analog 
interface is at the first stage of the valve in this case. 
Another example of parallel mechanization is shown in 
Figure 2-9. Here the unit is completely in digital form to 
the output actuator. The actuator in. this case is arranged 
in binary parallel form. 

An incremental type digital servoactuator has less severe failxire modes than its analog 
equivalent in that a hardover signal is only one pulse or one incremental change at the 
output. However, this type is usually severely rate limited because of the limiting 
valve cycling frequency and the small incremental change per cycle required to achieve 
positional accuracy; 

The parallel types begin to resemble analog with respect to failure modes. The worst 
hardover in this case is equivalent to a half hardover in a conventional analog servo- 
actuator. 

The digital strut appears to be impractical when applied to large load applications 
because of the size and complexity of the output actuator. 

2.3 SUMMAKY 

Table 2-1 summarizes in general the state of the art for the various disciplines. A 
conspicious trend is the absence of multiple systems (redundancy mechanization) 
development except in hydraulic analog servoactuators. 
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Figure 2-7. Incremental Digital Servo 
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Figure 2-8. Parallel Digital Servp 
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Figure 2-9. 


Digital Strut Actuator 


Table 2-1. State of the Art Summary 



MECHANICAL 

SLBGTyr^CK 

GAS 


HYIRAUUC 

PCWEK ACTUATION OPERATIOHAIj 

YES 

*YES 

YES 


YES 

FLiWc COKTROL SERVOS OPERATKHAL 

YES 

(SHALL <2 HP) 

YES 

(SMALL <2 HP) 

NO 


YES 

DSVSL0P1.EKT TESTING 



YES 

N. 


MULTIPtS CKAimSL & PCWER SERVOS . 
WITH AUrOlATIC FAULT CORRECTING 


• 




OPERATIONAL 

NO 

NO 

NO 


YES 

DBVElOPJ-IEKr TESTING 

HO ' 

NO 

NO 



STUDIES . 

NO 

NO 

NO 


- 
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2.4 RECOMMENDATIONS 


Based on the sui’ve 3^5 the following types of servpactuators were considered further: 

a. ‘ Hydraulic analog for all applications. 

b. Electromechanical analog for orb iter aileron only. 

An electromechanical arrangement was considered to be more adaptable to the orbiter 
aileron application because of the low load requirements and severe environment. 

(Refer to Section 3 for requirements.) 

One digital configuration was studied to provide a comparison with analog soiwoactuators. 

Neither the electromechanical nor digital configuration as shown in Section 4 is taken 
from previous studies per se. They are configured to meet automatic fault correcting 
criteria as established in this report and as such represent new concepts employing 
redundancy mechanization. 

Gas servo applications are not considered further. They appear to be the least desir- 
able of all the disciplines in terms of development effort required to achieve operational 
status within the short term future slated for space shuttle development. The scope of 
this study is to configure point designs that have the best chance of succeeding using 
the technology of today (1970). 
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SECTION 3 
REQUIREMENTS 


3.1 GENERAL 

For purpose of establishing point desigxi configurations the following vehicle baseline 
definition, servoactuator requirements, ground rules, and assumptions apply. 

3.2 VEHICLE BASELINE DESCRIPTION 

3.2. 1 GENERAL. The space shuttle concept consists of a two-stage, fully reusable 
system mounted in a piggyback fashion at liftoff. The lower vehicle acts as the booster, 
the upper vehicle completes the orbital phase of the mission. 

During the boost phase, only tlie booster vehicle’s rocket engines are operating and 
propellant is supplied from this stage. At staging, the orbital stage's rocket engines 
ignite and continue thrusting .to orbit. The booster element enters from the staging 
altitude and decelerates to subsonic velocity where it starts its cruise engines and flies 
back to the launch site unmanned under automatic control. Following preflight checkout, 
both elements are ready for payload integration, vertical assembly, refueling, and 
relaunch. 


The vehicles are both equipped with a fixed wing and a horizontal and vertical tail. Roll, 
pitch, and yaw control is achieved by using aileron, elevator, and rudder control sur- 
faces. The surfaces are not split. 

3.2.2 VEHICLE. STATISTICS 


a. Orbiter 

I 

Approximate gross landing weight 
Number of rocket engines 
Thrust rating/engine 
Both engines gimballed 

b. Booster 

Approximate gross landing weight 
Number of rocket engines 
Thrust rating/engine 
All engines gimballed 
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200.000 lb 
2 

400.000 lb (S.L.) 


500.000 lb 
11 

400.000 lb (S.L.) 



3. 2. 3 ALLOWABLE FAILURES - ROCKET ENGINES AND TVC 


a. Orbiter — Critical Mission Segment ‘ 

Lose one engine and/or TVC* — safe abort 

b. Booster 

Lose one engine and/or TVC* — complete mission 
Lose two engines and/or TVC* — safe abort 

3.2.4 ALLOWABLE FAILURES - AERODYNAMIC SURFACE CONTROLS. None. 
Elevators, rudder, and ailerons must function. 

3 . 3 SERVO ACTUATOR REQUIREMENTS 

3.3.1 PERFORMAN CE . For all functions the following characteristics apply:' 

Positional accuracj'' • • . 0.2% of total travel 

Frequency response (no load, closed loop) 

Frequency 

Amplitude ratio at 10% of v^ve saturation ±3 db 
Phase lag input amplitude • 45 deg 

Refer to Table 3~1 for other performance criteria. 

3.3.2 ENVIRONMENT. See Figures S-l and 3-2 for temperature-time histories 
for the orbiter and booster’, respectively. 

3.4 GROUND RULES AND ASSUMPTIONS 

3.4.1 INTERFACES 

3.4. 1.1 Command Channels. There are four electrical command channels available 
for use. It is assumed that all four signals are identical and proper to the servoactua- 
tor interface. The servoampUfier and summing point are included in the servoactuator. 


*Fail to null position - handover failures not allowed, (e. g. , no engine shutdowns 
permitted due to thrust vector control (TVC) failure). 
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Table 3-1. Performance Requirements 


Function 

Stage 

Max Static 
Hinge 
Moment 
Ft-Lb 

Max Rate 
No 
Load 
Deg/Sec 

Total 

Travel 

Deg. 

Redundancy Required 

Degraded 
Performance 
(after 1 
failure) 

Degraded 
Performance 
(after 2 
failures) 

Aileron 

Orbiter 

4, 800/side 

40 

±30 

Fail Operate, Fail Operate 
Degraded Perf . 

Negligible 

67% Max H.M. 
75% Max Rate 

.Aileron 

Booster 

19,200/side 

40 

±30 

Same As Above. 

Same As 
Above. 

Same As Above. 

Rudder 

Orbiter 

27,000 

30 

±30 

Same As Above. 

Same As 
Above. 

Same As Above. 

TVO 

each axis 

Booster 

65,000 

*10 

± .7 

Fail to Null 

- 


TVC 

each axis 

Orbiter 

65,000 

*10 

± 7 

1 

Fail Operate, Fail To Null 

Negligible 


Rudder 

Booster 

’ 

135,000 

30 

±30 

Fail Operate, Fail Operate 
Degraded Perf. 

Same As 
Above. 

67% Max H.M. 
75% Max Rate 

Elevator 
{ea of 
2 Units) 

Orbiter 

66,500 

30 

‘ ±40 

Same As Above. 

Same As 
Above. 

100% Max E. M. 
75% Rate 

Elevator 
(ea of 2 
Units) 

Booster 

325,000 

30 

±40 

Same As Above. • 

Same As 
Above. 

100% Max H.M. 
75% Rate 


' Q I , I, 

*TVC Actuators Are Always Loaded. At 10 /Sec, Hinge Moment Is 44,000 Ft- Lbs. 




Figure 3-2. Booster — Interaal Structural Temperature vs. Time 
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3 . 4. 1 . 2 Power Sources 


Electrical 

Number of sj’^stems available 

4 

115/200 Vac, 3 phase, 400 Hz 


Hydraulic 


Nmnber of systems available 

Vehicle APU 

4 

Rocket engine accessory pad 

As required 

Pressure 


No flow 

4000 psi 

Full flow 

2500 psi 

Temperature 

. , 

Maximum — > Normal operating 

350®F 

Minimum — Non-operating 

-20®F 


All operating pressure of 4000 psig maximum is chosen as a ground rule based on trends 
of present day large aircraft. The B-70 used 4000 psig and the SST has gone to 4000 
psig after many studies on the merits of 4000 psig versus the standard 3000 psig, 

Boeing showed a net '7% weight saving in favor of 4000 psig but noted that the weight 
savings maj'' be lost or reversed if the flight control actuators' sizes were determined 
by stiffness requirements.!'^ Subsequent to that study, Boeing selected 4000 psig. 
Results of an actuator weight study by Moog showed that optimum pressure is from 
3000 to 4000 psi for usual size loads (1000 to 10,000 ft-lb torque) but becomes higher 
for larger loads. However, the magnitude of weight improvement in the actuator is 
small.!® Perhaps that particular tradeoff of optimum pressure should be conducted 
for each new aerospace application; however, that tradeoff is not within the scope of 
this study. Regardless of the eventual selection, 4000 psig used here will still yield 
valid comparison evaluations. 

The pressure droop characteristic (2500 psi, maximum flow) is another ground rule 
established in anticipation of the eventual design requirements. That ground rule is 
discussed further in Section 3.4. 2. 

The 350® F maximum operating fluid temperature is chosen as a x-easonable compro- 
mise between two design considerations that tug in opposite directions — stiffness and 
thermal conditioning. Bulk-modulus (e. g. , actuator physical stiffness) lowers as fluid 
temperature increases. The weight penalty for transferring heat from a hydraulic 
system ixaturally goes up as ^maximum fluid operating temperature is lowered. 
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3,4.2 OUTPUT PO^VER. Preliminary data on surface hinge moment and rate 
requirements usually define the end limits ; that is , maximum stall liinge moment 
and maximum no load rate. The output of a hydraulic system will gi\>e a parabolic 
curve (A) as shown in Figure 3-3 , and this curve usually defines the requirements of 
hinge moment versus rate. However, the intermediate points are not defined and it 
is questionable whether they represent real requirements. If a constant output 
horsepower curve (B) can be defined as the real limit of liinge moment versus rate 
required for tlie intermediate points , then a reduction in delivered horsepower is 
possible. By allowing hydraulic pressure to droop with increased flow, the output 
will resemble curve C. Shotvn another waj'^ the required developed power in the 
hydraulic system is significantly reduced as shown in Figure 3-4. This affects APU 
size, APU fuel, transmission line size, and valve size. The APU and fuel weights 
reduce and the hydraulic transmission line size and valve weight increase (e.g. , 
lower allowable pressure drop). However, for the space shuttle application, oiil5’’ 
warm oil need be considered where tubing friction losses are low. The resulting 
increase in line weights is more than offset by savings in APU and fuel weight. 

There are some undesirable features in allowing the pressure to droop. One is 
that the servovalve flow gain becomes non-linear as shown in Figure 3-5. The flow 
gain is normally defined as output flow rate versus valve input at a constant pressure 
drop. The slope (flow gain) varies from a maximum for small valve inputs to a 



Figure 3-3. Hinge Moment vs. Rate 
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Figure 3-4. 


Hydraulic Power vs. 
Surface Rate 


Figure 3-5. Servo Valve Flow Gain 


minimum for full valve input due to the reduction in inlet pressure. This variance 
may be approximately 25% but is not considered to be a problem. The valve can be 
designed to compensate for this non-linearit5^ 


Allowing pressure to droop is not valid if maximum rate at high hinge moment 
•{typical of TVC) is defined as a requirement. 

3.4.3 ALLOWABLE CORRECTION (SIVITCHING) TRANSIENTS. The MS C space 
shuttle straight wing orbiter was examined to determine the vehicle response to 
control surface^ failure transients. Failure transients were simulated as triangular 
pulses having a specified failure surface rate and a specified area. The vehicle was 
examined at a cruise altitude of 20 , 000 ft and a velocity of 250 knots and at -surface 
rates of 5 to 30 deg/sec and accumulated errors of 0. 2 and 0. 5 deg-sec. Maximum 
error for the case of 30 deg/sec surface rate and 0. 5 deg-sec accumulated error for 
an elevator trailing edge down failure is +0. 048g and -0. 044 g. These accelerations 
are ivilhin the failure transient specification contained in MIL-F-8785Bj "Flying 
Qualities of Piloted Airplanes," paragraph 3.5.5, wMch requires transients to be 
less than ±0. 05g for a first failure. 

The 0.5 deg-sec transient is well within the capability of an automatic fault correcting 
actuator. For example, in a position summing arrangement, assuming a control 
channel (secondary actuator) time constant of 0.02 sec, an output rate due to one 
channel handover of 30 deg/sec, a failure not sensed until the channel is handover, 
and a 30 millisecond smtching time, the output transient would be approximately 
0, 1 deg-sec. 


3-7 



The 0.5 deg-sec transient may also be applied to the orbiter TVC as a reasonable 
allowable transient. The booster TVC criteria is not based on degree-seconds since 
one engine could go handover and control could be maintained. The limit is simply 
physical restraint and the allowable transient is more liberal than for all other appli- 
cations. 

The allowable transients listed above are much more liberal than can normallj’’ be 
permitted on high performance aircraft (which established correction transient 
allowables for most servoactuator designs). As such, correction transients become 
diminished in importance as evaluation criteria for this study. ' 

3.4.4. DUTY CYCLE. Duty cycles are defined so that power source fuel weight can 
be determined. Duty cycles are established for aerodynamic surface controls only. 
Thrust vector controls operate fox’ only short durations (approximatel3'^ three minutes 
compared to approximately two hours for aerod3mamic surface controls on the booster) 
and exert a minor influence on fuel weight. The duty cycle js given in terms applicable 
to hydraulic systems for the largest surface or demand on each vehicle. As such fuel 
weight will only be a factor in the largest surface servoactuator tradeoff comparison. 
See Table 3-2 for mission segments and duration. 

Table 3-2. Mission Segments and Duration 


TIME ~ SEC0I®S 


MISSION smmm 

-ORBITER 

BOOSTER 

Eimiy 

2000 

920 

I3UNSITIOK 

100 

100 

CRUISE 

6oo 

4700 

LANDING ' 

300 

hSo 

MISSION DURATION 

• 3000 

6200 


The duty cycles are 


a. 


b. 


Entry 

Transition 

Landing 

Cruise 


15% of maximum elevator rate — continuous 

100% of maximum elevator rate — 10% of the time 
% 

5% of maximum elevator rate — continuous 
100% of maximum elevator rate — 1% of the time 
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From the above data an average power in. % of maximum delivered power can be 
derived: 

Maximum Delivered Power = 100% Elevator Rate x 2500 psi 

Constant HP Loss (Pump & System Lealcage - 10% of a 4000 psi System 

= 10% X Max Del power 

\2500 / 

= 16% of Max Del power 
24% of Max Del power 

8% of Max Del power 

[at lower surface rates pump discharge pressure is approximate 4000 psi] 

Constant Losses + Continuous Cycling 

+ K(HP, - HP„ _ ) HP . - Average Power 

a S,D* AVii/ 

■ • ^1*0 o ~ Steady State Power 

s. 

K = % of Time @ Max Rate 

HP Delivered Power — 100% 

d 

3.4. 4.1 For Entry, Transition, and Landing 

hPave " ■” ^ 

HP . = 46% of Max Delivered Power 
AVE 

Adjusting to APU shaft power where delivered power e< 0, 9 shaft power, 
HP,„„ = 46% X 0.9 = 41.5%of APU Shaft Output Power 

A Vlii * ■ “ ‘ 

3.4.4. 2 For Cruise 

hp^ve "" 

HP . = 25% of Max Delivered Power 

AVE 

or 25 X 0. 9 = 23. 5% of APU Shaft' Output Power 


Steady Slate Power = 


=«\s. 


Continuous Cycling @ 15% = 15% “ 


® (Si) = 



3.4.4, 3 Averg.ge Power Over Total Mission 

a. Orbiter: 

jjp _ 41.5% (Entry + Transition + Landing Time) + 23. 5% (Cruise Time) 
AVE • Total Mission Duration 

HP ^ ^ 

AVE 3000 

= 38% of APU Rated Shaft Output Power 

b. Booster: 

. 41.5% (920 + 100 + 480) + 23. 5 (4700) 

^■^AVE “ 6200 

HP . = 30% of APU Rated Shaft Output Power 

AVE 


The average power shown above converted to hp-hrs and used with specific fuel con- 
sumption data shown in Section 6, Figure 6-10, determines fuel weight for each 
elevator configuration; see Section 7. 
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SECTION 4 


CONCEPTUAL DESIGN 


4.1 PO WEB CIRCUITS 

All aerodynamic surface controls are required- to be fail operate, fail safe. In this 
case fail safe means fail operate, degraded mode. Allowable degradation in terms of 
hinge moment is 67% for ailerons and rudders and no degradation for elevators.' To 
show convenient comparisons of the different applications, their requirements are 
converted to output power. This is done to provide a convenient base regardless of 
the type of power used (e.g., hydraulic, electrical, mechanical). The power listings 
below do not represent actual power developed but represent the minimum theoretical 
output required as shown on the constant power curve, Figure 3-3, Section 3. The 
constant power curve passes through the half hinge moment, half rate point wliich is 
used for this comparison. • Table 4-1 shows the output power requir-ed when applying . 
.multiple circuits per the failure criteria. For example,, each of four circuits need 
only supply half the power {hinge moment) that is required of each of three circuits. 
This indicates that a'four-power circuit arrangement is a candidate for large load 
applications because of the possible weight reduction over three-power circuits. The 
chart also identifies the type of power to be used based on the recommendations of the 
industry survey. 


Table 4-1. Output Power Required 


Application 

Min Req't 
(hp) 

Multiple Systems (hp/sys) 

. 3 Systems 4 Systems 

Aileron - orbiter 

3 

2 

1 

*Rudder - orbiter 

6.4 

4.3 

2.15 

*Aileron - booster 

12.2 

8.1 

4 

*Elevator - orbiter 

31.5 

•31.5 

• 15.75 

*Rudder - booster 

32 

21.5 

10.25 

^Elevator - booster 

155 

155 

77.5 

*TVC 

19. 7 Based on 70. 7% (Pitch + Yaw H. M. @10 deg/sec) 


^Applicable to hydraulic power and control only. Only hydraulics is con- 
sidered for these applications because it is the only technology that has 
combined large power requirements, multiple system output, and auto- 
matic failure correcting capability. 
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4.2 DESIGN APPnCATIONS 


Aerodynamic surface controls range from 9600 ft-lb hinge moment for the orbiter 
aileron to 650, 000 ft-lb for the booster elevator and suggest no common solution for 
all. To do a separate tradeoff for each of six surfaces would dilute the overall effort. 
It is reasonable then to break the applications down as follows: 

a. Booster critical -application {largest hinge moment) 

b . Orbiter critical application (largest hinge moment) 

• c. Smallest size. 

The elevator for each vehicle is the critical application. They have the greatest effect 
on vehicle weight (subsystem and interfaces). The orbiter aileron has the least effect 
on vehicle weight, is the smallest size, and is a candidate for something other than 
hydraulic power. The intermediate applications are not configured, but the data gen- 
erated is applicable. For example, qualitative comparisons for the elevator servo- 
actuators will apply to the intermediate size servoactuators due to similarity of the 
control portions. Weight is the major difference that might exist between the orbiter . 
elevator and rudder. 

Three configurations are established for each application to provide basis for tradeoff 
evaluation. These configurations are all of the analog type. One digital configuration 
is established for comparison to the analog versions. 

Three analog configurations are established for each of the booster and orbiter TVCs. 
They are studied separately .because of the different levels of redundancy required. 

The number of power systems to be used for TVC is based solely on redundancy re- 
quirements and not weight. 

4.3 DESIGN CONCEPTS . . 

As stated before, the majority of work has been accomplished in hydraulics. There 
are many tyPQS of redundancy mechanizations possible. Figure 4-1 is a flow chart 
showing many combinations that have been conceived to give automatic fault correc- 
ting capability. Reviewing the space shuttle requirements, the aerod 5 mamic surface 
controls must be fail operate, fail operate-degraded mode. This requires a minimum 
of three power circuits, three output actuators, and four control channels. Four 
channels are required to provide a two out of three agreement after one failure. Elec- 
tronic models are not used in this study. 

The flow chart is broken down to show major classifications of techniques used to 
achieve automatic fault correcting capability. Some of these terms are unique to this 
report and may not agree with all published data to date.. The following discussions 
describe these classifications. 
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AERODYNAMIC SURFACE CONTROI>S 
HYDRAULIC POWER 
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Figure 4-1. Flow Diagram Redundancy Mechanization, 2 Fail Operate 



4.3.1 LOAD SHARING VS. ACTIVE /STANDBY . (Tius section is concerned only with 
the power output portion of a servoactuator. Sections 4.3.2 through 4. 3. 11 are dis- 
cussions on the control portions only.) 

Load sharing has all output actuators active where they share tlie load equally. Active/ 
standby has only one output actuator active at one time. All other output actuators are 
bypassed. 

4.3.2 SECONDARY ACTUATORS VS. DIRECT DBIVEN SPOOLS. , A secondary actu- 
ator (sometimes referred to in other literature as servo ram or mod piston) is an 
intermediate actuator that converts an upper stage servmchannel command to a mech- 
anical output to drive a power spool. 

Secondary actuators came into being as a means of providing a mechanical equivalent 
of an electrical signal so that convenient summation with a pilot’s manual input to a 
servoactuator was possible. In a pure fly-by-wire arrangement, the need to produce 
a mechanical output from an elecLrohydraulic servo to sum with a pilot's mechanical 
command is unnecessary. A secondary actuator may be used, but for different reasons; 
remote location of a control package from a power valve and actuator, or the need to 
provide a convenient output of each command/servo channel for monitoring. 

"Direct driven spool" as used herein describes a power spool driven hydraulically by 
an upper stage (either a spool or first stage amplifier). In this case, secondary actu- 
ators are not used. ' 

4.3.3 FORCE SUMMING. Ail channel outputs are active and in parallel. Where 
secondary actuators are used (see Figure 4-2A) the output positions are common, and 
any force unbalance is due primarily to channel mismatch. Force summing arrange- 
ments must be synchronized to maintain static stiffness around null, prevent dead band, 
and reduce power drain. The power spools must also be synchronized either by some 
force balancing means or by close tolerance fabrication in the case of tandem spools. 

If secondary actuators are not used and direct driven spools cannot be synchronized by 
fabrication, force signals from the power output actuators can be used to synchronize 
the channels. Maintaining stability becomes a problem when inserting a pressure feed- 
back loop within a position feedback loop where the control or synchronization loop gain 
is nearly equal to the controlled or position loop gain. 

The output force of each channel being unique to that channel is used for self monitoring 
or comparison with the other channels in fault detection and correction logic. In a 
hydraulic arrangement, signals proportional to AP developed at each channel output 
(secondary actuator) are usually used for this purpose. 

A change in ou^ut does not occur after a failure thereby allowing a long switching 
time. There is negligible loss in performance after failure. Complexity is high be- 
cause of the synchronization required. 
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Figure 4-2. Control Channel Mechanization 










Another method of force summing is mid value logic. In a four-channel, secondary 
actuator arrangement, all actuate x'S" are in parallel. Detents are used with unequal 
breakout forces in opposite directions. Channel mismatch causes the secondary 
actuators to break out of their detents in the ensuing force fight. The unequal break- 
out forces are to ensure that one channel stays in detent and provides the output. There 
is a considerable problem in preventing all actuators from brealcing out and/or suffer- 
ing numerous channel disengagements (nuisance tripping) via fault detection and correc- 
tion logic with this arrangement. 

4.3.4 POSITION SUMMING . All channel outputs are active and in series. Position 
summing, Figure 4-2B, does not require synchronization (no force fight between chan- 
nels). Since an individual channel is not resisted by adjacent channels, a failure such 
as a hardover will cause output motion of the power actuator. In fact an output motion 
must occur for failure detection because position is unique to each channel and provides 
the intelligence for comparison to other channels to detect and switch out faults. When 
comparing force summing to position summing the methods used to deactivate a faulty 
channel are opposite. A secondary actuator' in a force summing arrangement must be 
bypassed since all actuators are in parallel. A secondary actuator in a position sum- 
ming arrangement is centered and locked. Therefore,, failures in a position summing 
arrangement reduce position authority of the common output which in turn reduces loop 
gain and maximum, rate capability of the output actuators unless some means of gain 
changing is used. 

4.3.5 VELOCITY SUMMING. A redundancy mechanization teclmique employing elec- 
tromechanical servo channels developed by LTV electrosystems uses velocity summing; 
see Figure 4-2C. The outputs of servo motors are summed through differentials to 
provide' an input to a hydraulic power spool. As channels are de-activated, velocity 
output of tile ball screw to the hydraulic power spool is reduced. Velocit 3 ^ summing is 
similar to position summing in that all outputs are in series, but failures in velocity 
summing reduce the velocity of the power spool rather than position which affects ac- 
celeration of the output actuator and not rate. 

4.3.6 A CTIVE /STANDBY-CONTROL CHANNE LS . Active/standby is self explanatory 
in that there is usually only one active output at one time. Engagement of standby 
channels are by predetermined sequence. All channels receive commands and fault 
detection and switching is achieved by position comparison of an element within each 
channel. There is no degradation in performance after a failure. 

4.3.7 SYNCHRONIZATION . In a force summing arrangement, synchronization 
usually consists of an equalization (or compensation) signal feedback to force all 
channels to seek a common null. Self equalization is contained within the channel; 
see Figure 4-3A. Load pressure is allowed to build up in a secondary actuator to a 
limit that satisfies ssmehronization (approximately 1000 psi in a 4000 psi system). As 
load pressure exceeds this limit, a proportionally larger signal is fed back to bias the 
servovalve in the direction to reduce the actuator AP. The correction signal stays 
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Figure 4-3. Control Channel Sj'nchronization 

f 

nearly constant until the AP reaches a minimum value (approximately 200 psi) then will 
reduce to zero. To accomplish this hysteresis effect, the equalization network consists 
of a preloaded piston and a LVDT. The equalization signal' is also directed to a detec- 
tion and switching function for de-activating the channel at a "failure threshold" limit. 

Force signals are averaged between two adjacent channels before being fed back as a 
biasing signal in a cross equalization scheme; see Figure 4-3B. Detection and correc- 
tion in tills case consist of comparing channel outputs (force) two-by-two and logically 
determining the faulty channel. 

Self equalization and cross equalization are synchronizing techniques that were devised 
primarily to meet the broader classification of self monitoring and cross monitoring, 
respectively. 

4.3.8 CROSS MONITORING. Cross monitoring or inter channel monitoring refers 
to any comparison arrangement requiring interchannel connections to implement fault 
detection logic. Figure 4-3B is an example of cross monitoring where some form of 
"majority vote logic" is used to detect and switch out a failure. 

4.3. 9 SELF MONITORING . SeK monitoring or intra channel monitoring does not use 
interchannel connections. The self equalization teclmique of Section 4.3.7 and its fault 
indication method is an example of self monitoring. In Figure 4-4, a monitoring chan- 
nel is added for comparison to each channel that provides an output. There are no 
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interconnections between the channels that provide outputs other than a device to engage 
standbj' channels. This approach x'equires more servo channels but fewer power sup- 
plies when compared to cross monitoring. For example, using electro hydraulic servo 
channels, cross monitoring requires four servo channels and four hydraulic systems 
whereas self monitoring requires six servo channels and three hydraulic systems for two 
fail operate capability. 

In Figure 4-5, the fault detection method is simply the comparison of output to input 
within one channel. This method is simple but has some disadvantages. For example, 
if the output meets stall load and the stall lasts the duration of a time delay,' all channels 
may be de-activated at once. 

4.3.10 ELECTRONIC LOGIC VS, HYDRAULIC LOGIC . Two fault detection and cor- 
rection methods widely used are electronic logic and hydraulic logic. Electronic logic 
has all comparison or monitoring information converted to electrical signals and utilises 
electronic devices for failure detection and switching. It is versatile in that it can be 
paclmged remote from the servoactuator, or its function can be removed entirely fi'om 
the servoactuator subsystem and assigned to the veMcle computer. Hydraulic logic is 
more of a specialty design integrated with the type of redundancy mechanization em- 
ployed by the servoactuator. For example, the hydraulic logic developed by Hydraulic 
Research for active/standby switching bears little resemblance to the hydromechanical 
logic used in the F-fll damper servoactuator.^® Hydraulic logic by necessity is pack- 
aged within the sem’’oactuator. 
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4. 3. 11 MONITOR VS. MONITORLESS . Figure 4-1 with all of its classifications of 
techniques for redundancy mechanizations describes monitored- sj's terns only. A moni- 
tored servoactuator is synonomous with detection-correction in this text. In a monitor- 
less servoactuator, a fault is not switched out but is simply overpowered by the remain- 
ing good channels . An example of a monitorless servoactuator is the one developed for 
the Saturn S-IVB by Moog, commonly called a majority voting servoactuator. In general, 
to achieve the same level of failure capability, a monitorless design requires more re- 
dundancy than a monitored design; however, it is not encumbered with detection and 
switching elements. 


4.4 CONFIGURATIONS 


4.4.1 SELECTION CRITERIA . As stated before in Section 4. 2, three configurations 
for each of five applications were established and, per the recommendations based on 
the industry survey, hydraulic analog concepts are configured for all applications and 
one electromechanical configured for the smallest load application (orbiter aileron). 

In addition, one digital concept was established to meet the surface controls failure 
capability. It should be noted here that a concept using electromechanical servos to 
control hydraulic power stages is classified as a hydraulic concept. 
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Hjrdraulic concepts were given preliminary evaluation based on redundancy performance, 
complexity, and development status. Redundancy performance includes criteria such as 
nuisance tripping and effects after failure. 

The- electromechanical concept (compared to other electx'omechanical) was evaluated on 
normal performance as well as the critei'ia above. 

4.4.2 AERODYNAMIC SURFACE CONTROLS . Refer to Figure 4-6 for descriptions 
of the configurations and where they are applied. These were selected to represent 
the best candidates and also to provide meaningful trends over wide ranges of loads 
and sizes. Electromechanical control (velocity summing) is used with three hydraulic 
power circuits to delete the need of a fourth small hydraulic circuit just for control 
channel power. Electromechanical control could also be used with four hydraulic power 
circuits . A weight comparison is made in Section 8 between electromechanical and 
hydraulic servo control portions only. The electromechanical control is a candidate 
for all three applications so that this comparison can be made. 

Although a four-power system appears to weigh less than a three-power system fo.r 
large load applications, a three-power system is a candidate for the elevator applica- 
tions to show the weight trends of four versus thi'ee through this range of large loads . 

The booster and orbiter elevators have the same configurations because they have much 
in common. Although the booster loads are much larger, both surfaces must be classi- 
fied as being big. They are the driving functions for both vehicles (e.g. , they determine 
interface sizes and quantities). 

One principal difference between the elevator configurations 1 and 2 (see Figures 4-7 
and 4-8, respectively) is the physical installation, Configuration 1 has four separate 
control packages, each mounted integrally with an actuator. Configuration 2 has one 
large control package and could be installed remote from the actuator such that only 
fluid and electrical lines interconnect the two. The control package location must not 
be so remote that fluid line compliance would seriously degrade hydraulic stiffness. 

4.4.2. 1 Booster and Orbiter Elevator — Configuration 1 (Figure 4-7) . Theunithasan ■ 
all active-force summing control mechanization. Four hydraulic power systems and 
four separate valve/actuators are used. The control sections are force summed through 
a mechanical shaft. The secondary actuators are synchronized by a self-equalization 
loop fed back within each channel to keep all secondary actuators within predetermined 
synchronous limits. The equalization signal (force signal) is also used for fault detec- 
tion and correction. When a chahnel output reaches a threshold of failure, power is 
removed from the continuously energized shutoff valve. With the shutoff valve off, the 
pressure operated bypass' valve shifts to bypass tiie secondary actuator. Hydraulic 
pressure to a power actuator is not affected by a channel failure that de-activates a 
secondary actuator. Each control channel loop is closed by electrical position feedback 
from secondary actuator to servo amplifier. 
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Figure 4-6. Aerodynamic Surface Control Applications 


4-11 














4-12 


ELECTRICAL - 

mmMJJAC 

\ *” 

NffiCHAMICAL c- 


TO FAILURE 
WARNING 



1, 

2, 


3. 


4. 

5. 

6. 
7* 
Q. 
9. 

10 . 
11 . 
' 12 . 


SERVO Ai'EPLirTER I ^ 

elect/kyd servo valve I 

? S.O. 3 

SOL SHTrropp valve ' 

TO 

BY- PASS VALVE S.O. 4 

i ' 

rETiJI^T 

SECOI,T)i\RY ACTUATOR 
I,VIT 

CC^^?ENSATIOI^ PISTON 
LVDT ' 

POWER SPOOL 
OVERPRESSURE BY-PASS 
STATIC PRESSURE FEEDBACK 



13. PG/ER ACTUATOR 

14. ^ TIME DELAY 

15. SYNCHRONIZING SHAFT 


3 


Figure 4-7. Booster and Orbiter Elevator - Configuration 1 


















Each power actuator is sized for one-half the maxiinum hinge moment so that 100% of 
the required hinge moment is available after two hydraulic failures. Null synchroni- 
zation. of the power spools is achieved by use of static pressure feedback. TMs in 
effect softens the pressure gain of each power spool at null, thus preventing a force 
fight between hydraulic circuits. A jammed secondary actuator or power spool can be 
driven out of its detent by the three good channels. The detent breakout force is set 
below the output of any two secondary actuators operating w’itliin their synchronous 
limits. This is to prevent dismgagement of channels when they are driving against 
this load. Over pressure bypass on the output is provided to allow the three good out- 
puts to follow commands. Mechanical feedback closes the outer loop from the actuator 
to the power spool. 

4.4. 2. 2 Booster and Qrbiter Elevator ~ Configuration 2 (Figure 4-8). This unit is 
all active-force summing. Equalization (force) signals from secondary actuators ai’e 
averaged between channels before fedback to the servoamplifiers to sjmchronize chan- 
nels. Electronic fault detection and correction logic is used. When one channel fails, 
the logic conipares channels on a two-by-two basis, detects the faulty channel and by- 
passes the secondary actuator by sending a signal to de-energize the normally ener- 
gized shutoff valve which in turn cycles the bypass valve to bypass. The four channel 
Control and the pow'er spools are integrated into one paolmge and can be remote from 
the output actuators. 

Each of the output actuators is sized for one-half hinge moment so that 100% of the 
required hinge moment is available after two hydraulic failures. The power spools are 
synchronized by fabrication, where all circuits null within approximately 1000 psi AP 
of each other. There are no provisions for power spool jams other than the overpower- 
ing force of the secondary actuators. Electrical position feedback is used to close all 
control loops . . . • 

4.4.2. 3 Booster and Qrbiter Elevator — Configuration 3, (Figure 4-9); Orbiier Aileron — 
Configuration 3 . This unit is all electromechanical in the control stages. The ac servo- 
motor and differentials arr^ged in an all active, velocity summing arrangement provide 
a ballscrew output to drive hydraulic power spools. The servo motors incorporate a 
fixed phase and control phase winding and normally electrically energized brake (brake 
off). The control phase accepts a variable voltage input to control the output. Each 
channel incorporates velocity (tachometer) feedback which is also used for channel 
comparison. When a channel reaches threshold of failure (disagreement mth adjacent 
channels) the electronic detection and switching logic signals the faulty channel to shut 
down. Power is removed from the control phase winding and brake, locldng the output. 
The output velocity to the ballscrew is reduced 25% after each channel failure. A back- 
up differential and ballscrew is provided. Should the primary balls crew/differential 
jam, the back-up ballscrew is driven out of its detent to drive the power spools. 

Each output actuator is sized.for full hinge moment to provide 100% capability after two 
failures. The triple tandem spools are synchronized by close tolerance fabrication. 
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Figure 4-8. Booster and Orbiter Elevator - Configuration 2 
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Figure 4-9. Booster and Orbiter Elevator - Configuration 3; Orbiter Aileron ~ Configuration 3 












4.4. 2.4 Qrbitei^ Aileron - Configuration 1 (Figure 4-10). The unit is active/staadby 
eniploying hj^draulic logic. Secondary actuators are not used. The active and two 
standbj' circuits each have two servo channels, one being a monitor with no output. 

The system is self monitoring with no cross comparison between channels that have 
outputs . The lockout solenoid valves are energized momentarily to cycle the unit to 
the starting position shown. Fault correction logic consists of hydraulic flapper/nozzle 
assemblies that port pressure proportional to electrohydraulic valve spool position to 

a spring loaded slide valve called a comparator. If spool positions disagree between 
the active channel and its monitor by a predetermined amount, the AP on the comparator 
causes it to sMft, which in turn causes the engage valve to sliift, bypassing the active 
output and engaging the first stmidby. The lockout valve (de-energized) cycles upon 
collapse of control pressure to prevent re-eng^ement of the channel. If eitlier standby 
channel should fail first, separate shutoff valves cycle to prevent engagement. A hy- 
draulic piston pressurized by the first standb 3 r circuit provides an additional engage 
valve position should the first standby fail first. Pressure scotches in the comparator 
valve provide intelligence for failure indication. 

Because the mechanization requires six servo channels, voters are placed betw'^een the 
four channel inputs and the six driving servo amplifiers. This allows up to two erron- 
eous command inputs to be voted out before reaching the seiwos. Electrical feedback 
is used to close the control loop. Each actuator is sized to 100% of maximum required 
Iiinge moment. 

4.4.2. 5 Qrbiter Aileron - Configuration 2 (Figure 4-11). This unit is all electro- 
mechanical employing spring clutches. Three electiacal power systems are clutched 
in upon electrical command and summed through a triple differential to provide output 
to a single ballscrew actuator. -Two clutches are requii'ed per circuit to give bi-direc- 
tional motion. The input signals from four channels are conditioned to permit only 
signals of sitfficient level to energize the solenoids (or coil energizers) to prevent 
clutch slipping. The clutches transmit power from a continuous rotafang input shaft at 
constant rate. Fault detection is self monitoring, comparing input to output. If there 
is no output with an input signal present, power is removed from that channel and the 
output is locked by means of a brake incorporated within each clutch assembly. The 
signal conditioning electronics also includes failure detection and s\vitclung logic to 
remove an erroneous command signal so that comparison can be made after one failure. 

Due to the triple differential summing arrangement, failures cause unequal effects. 
Should either channel 1 or 2 fail, for example, the output ballscrew rate is reduced 25%. 
If channel 3 fails, the output rate is reduced 50%. There is no degradation in hinge 
moment after failure but there is a degradation in surface rate. 

4.4, 3 THRUST VECTOR CONTROLS . See Figure 4-12 for descriptions of the config- 
urations and where they are applied. 
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Figure 4-12. TVC Applications 


The orbiter and booster TVC configuration 1 are common and utilize the vehicle central 
APU driven hydraulic circuits. The centering power for this case is an accumulator 
checked off from an active hydraulic circuit. 


To see how the APU systems are arranged, refer to Figure 4-13. The dual blocks 
represent dual tandem actuators and the numbers witliin tiie blocks represent the power 
circuits. One can see that one hydraulic circuit loss does not shut do\vn any TVC. A 
second hydraulic failure shuts down two TVC systems on the booster and one TVC sys- 
tem on the orbiter. The configuration is more redundant than is normally required 
(fail to null) for the booster, but it eliminates the need for 11 separate hydraulic circuits, 
one per rocket engine. The addition of power distribution lines from the APU hydraulics 
is the only power penalty applied to this configuration since the power supplies are sized 
by the aerodynamic surface controls. 


Configurations 2 and 3 for the orbiter require three active hydraulic systems per TVC 
due to continuous channel control power consumption . 

The booster configurations represent three levels of redundancy. Configuration 1 has 
the highest level to be able to use only 4 hydraulic power circuits for all 11 engines. 
Configuration 3 has the least redundancy in the control channels, sufficient to prevent 
hardover on the first failure. This configuration meets only the fail to null requirement. 
Configuration 2 has three channels because it is monitorless in the control channels. 

The only detection and switching occurs when the actuator is centered after loss of 
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BOOSTEB - TVC ACTUATOR A RSANGEME NT 



ENGINE #1 ENGINE #2 ENGINE #3 




#10 #11 


ORBITER - TVC ACTUATOR 
ARRANGEMENT 


LEGEND: 

H TANDEM. 
ACTUATOR 

1 APU #1 POWER 
2 APU #2 POWER 
3 APU #3 POWER 
4 APU #4 POWER 



ENGINE #1 ENGINE #2 


Figure 4-13. APU Driven Hydraulic Circuits for TVC — Configuration 1 

hydraulic control power. Configuration 2 is fail operate degraded if the failure is con- 
fined to the upper servo. portions where redundancy exists. It can survive many com- 
binations of failures providing there are no two like failures. 

4. 4.3.1 Orbiter and Booster TVC — Configuration 1 (Figure 4-14). The unit is 
active/standby employing hydraulic logic. The active and standby circuits each have 
two servo channels, one being a monitor wdth no output. The unit is self monitoring 
with no cross monitoring between Pj and 1?2 outputs. The lockout solenoid valves (6) 
are energized momentarily to C 3 'cle the unit to the starting position shown. Fault 
correction logic consists of hydraulic flapper/nozzle assemblies (4) that port pressure 
proportional to electrohydraulic valve spool position to a spring-loaded slide valve (5) 
called a comparator. If spool positions disagree between active channel and its monitor 
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SOL LOCKOUT VALVE 
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SOL. CENTERING VALVE 

HYDRAULIC 

7. 

SIRJTOPF Si BYPASS VALVE (SYS 1) 



MECHANICAL . 


Figure 4-14. Orbiter and Booster TVC - Configuration 1 











by a predetermined amount, the AP on the comparator causes it to shift, which in turn 
causes the engage to shift bypassing the active output and engaging the standby. The 
lockout valve (de-energized) cycles upon collapse of control pressure to prevent re- 
engagement of the channel. If the standby should fail first, its shutoff and bypass valve 
(9) prevents engagement. Pressure switches in the comparator provide intelligence 
for failure indication and actuator centering. After two failures, Pi and P 2 hydraulic 
pressure is shutoff and tlie centering valve energized, porting P 3 (accumulator) to the 
centering and locldng actuator. 

Each half of the tandem actuator is sized for full hinge moment. Electrical position 
feedback is used to close the loop around the servoactuator. 

4.4. 3.2 Orbiter TVC — Configuration 2 (Figure 4-15) . Three active channels powered 
by three hydraulic circuits provide a common output that controls a tandem output actu- 
ator. P3 is used as a standby and switched into the power actuator in event of loss of 
either Pi or P 2 . The servo channels use secondary actuators mechanized to provide 

a force summed output. To minimize the force unbalance the three channels are Sjm- 
chronized'by force signals (AP) returned to the electronic comparison, detection and 
switching logic where an equalization signal is fed back to each channel forcing them 
to a common null. If one channel (e.g. , secondary actuator AP) reaches a predetermined 
threshold of disagreement with the other channels, it- is shut off via the detection and 
switching logic, and the secondary actuator is bypassed. 

Electrical position feedback closes the control loop from the secondary actuator to the 
servo amplifier. After a second failure all channels are shut down and all secondary 
actuators center. Center position of the secondary actuators is coincident with geo- 
metric center of the power actuators due to the mechanical feedback arrangement. 

Each half of the tandem power actuator is sized to provide full hinge moment. 

4.4. 3. 3 Orbiter TVC — Configuration 3 (Figure 4-16). Two hydraulic circuits (Pj and 
P 2 ) and corresponding servo channels provide active outputs to a tandem power actuator, 
whereas the servo channel powered by P 3 serves only as a model. All channels use 
secondary actuators mechanized to provide position summing of the outputs of channels 

1 and 2. If one secondary actuator position reaches a predetermined threshold of dis- 
agreement with the other secondary actuators, the electronic detection and switching 
logic shuts off that channel. As hydraulic pi'essure collapses tlie affected secondary 
actuator centers and locks. If an active actuator is centered, the output stroke to the 
power spool is halved and gain and output rate are reduced. A second failure that will 
cause sufficient disagreement between the two remaining channels will shut down all 
channels via the detection and switching logic. All secondary actuators center and lock. 

In addition the power conti'ol actuator is by -passed by action of the power by-pass valves, 
allowing the centering actuator to center and lock the TVC. The centering valve is 
energized by the same intelligence that de-activates ail channels. 

Each half of the tandem power actuator is sized to provide-full liinge moment. 
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i. SERVO i\MPJLIFIER 
Z. 2 STAOE E/K 
SERVO VAi>YE 

3, SOL SHUT OFF VALVE 

4. BY-PASS VALVE 

B. SECONDARY ACTUATOR 


6, LVDT 

7. sensing 

3. POWER SPOOL 
9* SWITCHING VALVE 

10, POWER ACTUATOR 

11. ACTUATOR LOCK 


ELECTRICAL ^ 

HYDRAULIC 

MECHANICAL i n 


Figure 4-15. Orbiter TVC - Configuratton 2 
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Figure 4-16. Orbiter TVC — Coufiguratioa 3 

















4.4. 3.4 Booster TVC — Configuration 2 (Fig;ure 4-17). This mit is moiiitorless (no 
detection or correction in tlie servo channels). It has one active hydraulic circuit that 
powers three servo channels. The first stage eleotrohydraulic valve outputs are flow 
summed to drive a common power spool, which in turn controls the power actuator. A 
bad output from any channel will attempt to drive the power spool. Mechanical feedback 
from the spool to each first stage will direct the two good channels to oppose the dis- 
crepant signal. Single faults in the servo upper stages, therefore, are overpowered 
and no switching is required. There is some degradation (unsymmetrical respoiise, 
slight output position change, loss of control sensitivity about null) after a failure de- 
pending on the nature of failure. The unit can survive many combinations of dual fail- 
ures but cannot tolerate two like failures (e.g. , two channel hardovers in the same 
direction). 

Centering and locking provisions are incorporated into the power actuator. A second 
h 5 fdraulic circuit, I >2 (accumulator), is switched in to center the actuator should the 
active circuit, fail. 

4.4.3. 5 Booster TVC — Configuration 3 (Figure 4-18). This unit has one active hy- 
draulic circuit, Pj^. A second hydraulic circuit is used to power a monitoring channel 
and provide centering. The two servo channels are required to prevent a handover 
output. Hydraulic logic is used (e.g., the monitors, comparator and shutoff and 
bypass are hie same as described in Section 4. 3. 3.1). A secondary actuator is used 
on the active channel. When there is sufficient disagreement between channels, pres- 
sure is removed from the secondarj^ actuator and it centers. Center position is coin- 
cident with geometric center of the power actuator due to the mechanical feedback 
arrangement. The centering valve is triggered by either loss of P]^ hydraulic pressure 
or servo channel disagreement, to port centering power to -the tandem power actuator. 
Should ?2 fail first, Pj is available to center the power actuator. 

4.4.4 DIGITAL CONFIGURATION . .One digital design is configured to satisfy the two 
fail operate requirements for aei'odynamic surface controls. This configuration, Fig- 
ure 4-19, was selected because it is all digital except for the output actuator. To ex- 
tend digital design' to include the output actuator (digital strut) would result in a very 
large and complex actuator. Torque motors rather than solenoid valves are used in 
the upper stages because of the severe cycling requirements (number and frequency). 

Figure 4-20 is afunctional schematic that shows detail operation of one channel. Com- 
mand signals are received in incremental form. For each signal pulse, the torque 
motor drives die pilot stage spool. Pressure is boot strapped to drive the pilot stage 
spool after initial movement to reduce the signal level and pulse duration required on 
the torque motor. The pilot stage spool directs pressure to the main power spool, 
positioning it to open pressure to one cylinder port. The flow from the opposite cylinder 
port drives the digitizer spool against a stop. The displacement of the digitizer spool 
represents the incremental displacement of the actuator for one pulse. When the signal 
is removed from the torque mbtor, the pilot stage and power spool center, blocking the 
actuator ports and recycling the digitizer spool. 
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Two digitizers are used. The smaller gives 0,2% positional accuracy per requirements 
of Section 3, but has limited rate capability. Rate capability is based on the assumption 
that the maximum practical cycling rale attainable is 30 Hz. The larger digitizer gives 
maximum rate required but has a larger displacement per cycle. 

The large digitizer would normally receive signals for large surface position changes. 
The small digitizer acts as a vernier for accurate positioning. The digitizers opej’ate 
in sequence, not in parallel. 

The fault correction consists only of overpressure sensing on the output actuators. If 
one actuator is not in agreement and is driven by the other three, it will be switched 
off when sufficient disagreement is reached. This "force voting" on the output requires 
four systems to enable correction after a second failure. 
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U SERVO AMPLIFIER 5. CYLINDER L'OCK 

2. SINGLE STAGE E/H 6, PRESSURE SWITCH 

SERVO VADVE 7. SOLENOID OPERATED 

3. POWER SPOOL CENTERING VALVE ' 

4* BY-PASS 3. POWER PISTON 
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HYDRAULIC 

MECHANICAL r r 


Figure 4-17. Booster TVC - Configuration 2 
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Figure 4-18. Booster TVC 


Configuration 3 









4-29 



1* 

VAI.VE CONTROLLER 
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Figure 4-19, Digital Configuration. 













Figure 4-20. Digital Ser-vo Schematic 
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SECTION 5 

FAILURE MODES AND EFFECTS ANALYSIS 


5.1 DEFINTTIONS 


Refer to pages 5-3 through 5-23 for the failure modes and effects analysis of the 
eleven candidate configurations. 

Jamming failures of output linear hydraulic actuators are not considered in this 
analysis . This is in keeping with past experience that this type of failure mode 
is virtually non-existent. 

The last column, entitled Failure Category, carries the folloiving definitions: 


Category I 


Single failure or failure level that could cause loss of 
personnel or vehicle. 


Category II 


Single failure or failure level whereby the next associated 
failure could cause loss of personnel or vehicle. 


Category in - Single failure or failure level that can be sustained \vithout 
loss of primary mission objectives; or the single failure or 
failure level whereby the next associated failure could cause 
loss of primary mission objectives.. 
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ASC 

CONFIGURATION 1, ELEVATOR 

- BOOSTER AND ORBITER 

ITEM 

failure mode 

, PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

1 

LOSS OF ONE HYD. 
SYSTEM 

0 FLUID LOSS 
o PUMP FAILURE 

LOW PRESS WARN- 
ING 

SECONDARY ACTUATOR BY- 
PASSED 

*2 

LOSS OF TWO HYD. 
SYSTEMS 

SAME AS 1 

SAME AS 1 

TWO SECONDARY ACTUATORJ 
BYPASSED 

3 

HARDOVER SlONAl 

• LOSS OF SIGNAL 

• ELECT. HARDOVER 

• OPEN FEED BACK 
« PLUGGED NOZaUS 

HYD. AMPLIFIER 

FAULT INDlCATIO^ 
-DETECTION AND 
SWITCHING LOGIC 

FORCE (^P) SIGNAL FROM 
SEC. ACTUATOR DE- 
ENERGIZES SHUTOFF. SEC. 
ACTUATOR BYPASSED. 

4 

HARDOVER SIGNAL- 
WITH ONE CHAN- 
NEL DE-ACTiVATEE 

SAME AS 3 

SAMS AS 3 

SAME AS 3 

5 

JAMMED BYPASS 
SPOOL - (WONT 
BYPASS) 1 

0 CONTAIvlINATlON 
• BROKEN SPRING 

NOT DETECTED 

NONE 

1 

HARDOVER SIG- | 
NAM SECOND j 

FAILUIE) i 

1 

! 

' *• j 

SAME AS 3 

FORCE SIGNAL DE- ENERGIZE 
SHUTOFF. SEC, ACTUATOR 
WONT BYPASS 


i 

JAMMED SEC. 
ACTUATOR 

♦ CONTAMINATION 
•STRUCTURAL 
FAILURE 

SAME AS 3 ‘ 

FORCE SIGNAL DE-ENERCIZE 
SHUTOFF 

7 

JAMMED MAIN 
POWER SPOOL 

/ 

SAME AS 6 

j 

i 

SAME AS 3 

i 

, SAME AS 6 

! 1 


USAGE; 2 PLACES 


SHEET 1 


EFFECT CM SYSTEM , EFFECT ON VEHICLE CATEGORY 

NO OUTPUT FROM ONE CIR- NO DEGRADATION lU 
CUIT. PASSIVE SEC. ACTU- 
ATOR DRIVEN BY 3 GOOD 
CHANNELS 

NO OUTPUT FROM TWO CiR- DEGRADATION IN II 

CUITS. PASSIVE SEC, ACTU- SURFACE RESPONSE 
ATORS DRIVEN BY 2 GOOD GAIN h STIFFNESS 
CHANNELS 

OUTPUT FROM ONE CON- SAME AS 1 HI 

TROL CHANNEL DE- 
ACTIVATED. ALL POWER 
CIRCUITS OPERATIVE 


2 CONTROL CHANNELS SLIGHT DEGRAD A- IX 

DE-ACTIVATED. ALL PO\VER TION IN SURFACE 
CIRCUITS OPERATIVE RESPONSE 

NONE BY ITSELF NO EFFECT U1 . 


SECONDARY ACTUATOR SAME AS Z II 

BREAKS OUT DETENT AND 
DRIVES POWER SPOOL. 

GOOD CIRCUITS »'BUCK*' OUT 
HARDOVER ATTEMPT. 

SMALL SURFACE POSITION 
CHANCE 

3 GOOD CHANNELS MAIN- SAME AS 2 ll 

TAIN POSITION CONTROL 
AND DRIVE JAMMED ACTUA- 
TOR OUT OF detent. OVER- 
PRESSURE BYPASS OPENED 
ON AFFECTED POWER 
ACTUATOR 


SAME AS 6 


SAME AS 2 


II 
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ASC 


CONFIGURATION 1. ELEVATOR - BOOSTER AND ORBITER 


USAGE: Z PLACES 


SHEET 2 


ITEM 

FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILURE 

CATEGORY 

8 

DETECTION AND 
SWITCHING LOGICS 
ONE OPEN 

BROKEN WIRE OR 
OPEN CONNEC- 
TION 

FAULT INDICATION- 
DETECTION AND 
SWITCHING LOGIC 

SHUTOFF VALVE DE-ENERGIZ 
ED SEC. ACTUATOR BY- 
PASSED 

• OUTPUT FROM ONE CONTROl 
CHANNEL DE-ACTIVATED. 
ALL POWER CIRCUITS OPERA 
TIVE 

NO DEGRADATION 

m 

9 

SOL SHUTOFF 
VALVE - OPEN 

SAME AS 8 

NOT DETECTED 

SAME AS 8 

SAME AS 8 

SAlvlE AS 8 

m 

iO 

SOL SHUTOFF 
VALVE -STUCK IN 
ENERGIZED POSI- 
TION 

CONTAMINATION 

NOT DETECTED 

NONE 

NONE 

NO EFFECT 

III 


HARDOVER SIGNAL 
(2ND FAfLURE) 

- 

SAME AS 8 

SHUTOFF VALVE DE-ENERGiZ- 
ED. VALVE WONT CYCLE 

SAME AS 5 

SAME AS 2 

11 

n 

CONTROL MIS- 
MATCH, PRES^ 
VOLTAGE, GAIN, 
RESPONSE 


NOT DETECTED 
UNLESS mis- 
matches REACH 
FAILURE DETEC- 
TION THRESHOLD. 
(NUISANCE TRIP) 

NONE REQUIRED UNTIL FAIL- 
URE THRESHOLD IS REACHED, 
THEN RESULT IS S^ME AS 3 

‘EQUALIZING CIRCUITS ON 
EACH CHANNEL PROVIDE 
BIAS SIGNAL TO SERVO AMP 
TO FORCE ALL CHANNELS 
TO COMMON NULL. 

NO EFFECT 

m 

12 

SYNCHRONIZING 

SHAFT-BROKEN 

STRUCTURAL 

FAILURE 

NOT DETECTED 

NONE 

LARGE DEAD ZONE AND LOSS 
OF STIFFNESS 

SERIOUS DEGRADA- 
TION IN PERFOR- 
MANCE & POSSIBLE 
LOSS OF PITCH CON 
TROL 

I 

13 

INTERNAL LEAK- 
AGE HIGH RATE 

♦ FAILED SEAL 
ACTUATOR PIS- 
TONS , 

♦ EROSION/WEAR 
LAPPED SPOOLS 
NOZZLE 

NOT DETECTED 
UNLESS CHANNEL 
PERFORMANCE DE- 
GRADES TO FAILURE 

threshold 

NONE UNTIL FAILURE THRES- 
HOLD IS REACHED, THEN RE- 
SULT IS same as 3 

‘•FLUID HEATING 
• LOWER SERVO GAIN 
♦LOWER LOAD CAPABILITY 
ON ONE CIRCUIT 

SAME AS 1 

HI . 

14 

, , , 1 , 

EXTERNAL LEAK- 
AGE HIGH RATE 

•ROD DYNAMIC . 
SEAL 

•STATIC SEAL TO 
AMBIENT 

LOW PRESS 
WARNING WHEN 
CIRCUIT FLUID IS 
DEPLETED 

SECONDARY ACTUATOR BY- 
PASSED WHEN CIRCUIT 4S 
DEPLETED. 

SAME AS 1, POTENTIAL 
SAFETY HAZARD EXISTS 
WITH OIL SPILLAGE 

jsAME AS 1 

m 

! ^ 

1 : 
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ASC 


CONFIGURATION 2, ELEVATOR BOOSTER AND ORBITER 


USAGE: 2 PLACES 


SHEET Z 


i ^ 


ITEM 

FAILURE mode 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

HHM 

8 

DETECTION AND 

BROKEN WIRE OR 

SAME AS 3 

SAME AS 3 

SAME AS 3 

SAME AS 1 

III 


SWITCHING LOGIC- 

OPEN CONNECTION 







ONE OPEN 







9 

SOL. SHUTOFF 

SAME AS 3 

SAME AS 3 

SAME AS 3 

SAME AS 3 

SAME A^ 1 

III 


VALVE - OPEN 








SOL, SHUTOFF 
VALVE - STUCK IN 
ENERGIZED POSI- 
TION 

CONTAMINATION 

NOT DETECTED 

NONE 

NONE 

NO EFFECT 

111 


HARDOVER SIGNAL 


SAME AS 3 

DETECTION SIGNAL TO SHUT- 

3 GOOD CHANNELS MAINTAIN 

SAME AS 2 

II 


(2ND FAILURE) 


* 

OFF VALVE. VALVE CAN'T 

CONTROL. LOSS IN SERVO GAIN 







SHUTOFF. SECONDARY ACTUA- 
TOR WON'T BY-PASS 

h RESPONSE 



a 

CONTROL MIS- 


NOT DETECTED UN- 

NONE REQUIRED UNTIL FAIL- 

EQUALIZING CIRCUITS BE- 

NO EFFECT 

Ui 


MATCH - PRESS. 


LESS MISMATCHES 

URE THRESHOLD IS REACHED. 

TWEEN CHANNELS PROVIDE 




VOLTAGE. GAINS 


REACH FAILURE 

THEN RESULT IS SAME AS 3 

AVERAGING BIAS SIGNALS TO 




RESPONSE 


DETECTION THRES- 


EACH SERVO AMP TO FORCE 






HOLD (NUISANCE 


ALL CHANNELS TO A COMMON 






TRIP) 


NULL 



12 

INTERNAL LEAK- 

* FAILED SEAL 

NOT DETECTED 

NONE UNTIL FAILURE THRES- 

*FLUID HEATING 

SAME AS 1 

ill 


AGE - HIGH RATE 

ACTUATOR PISTONS 

UNLESS CI-iANNEL 

HOLD IS REACHED, THEN RE- 

•LOWER SERVO GAIN 





^'EROSION/W'EAR 

PERFORMANCE , 

SULT IS SAME AS 3 

•LOWER LOAD CAPABILITY 





LAPPED SPOOLS 

DEGRADED TO 


ON ONE CIRCUIT j 




- 

NOZZLE 

FAILURE THRES- 
HOLD 

i 




13 

external leaij:- 

• ROD DYNAMIC SEAL 

LOW PRESS WARN- 

SECONDARY ACTUATOR BY- 

SAME AS L POTENTIAL SAFETY 

.SAME AS 1 

i III 


AGE - HIGH RATE 

• STATIC SEAL TO 

ING WHEN CIRCUIT 

PASSED WHEN CIRCUIT IS 

HAZARD EXISTS WITH OIL 


! ! 

L 


ambient 

FLUID LS DEPLETED 

i 

1 

! 

DEPLETED 

SPILLAGE 

1 

i 

_ 
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CONFIGURATION 3 ELEVATOR - BOOSTBR AND ORBITER 


CONFIGURATION 3« AILERON - ORB ITER 


item failure mode 


PRIMARY CAUSE 


8 JAMMED STANDBY SAME AS 7 
OUTPUT - BAJLL 
SCREW OR DIF- 
FERENTIAL 


DETECTED BY 


NOT DETECTED 


FAILURE CORRECTION 


EFFECT ON SYSTEM 


NONE- STANDBY NORMALLY NO EFFECT 

GROUNDED AGAINST FUNK 

STRUT 


effect ON VEHICLE CATEGORY 


NO EFFECT 


9 JAMMED ACTIVE 
OUTPUT - BALL 
SCREW OR DIF- 
FERENTIAL 


SAME AS 7 


SAME AS 8 


.WHEN FORCE LEVEL EXCEEDS 
FUNK STRUT BREAKOUT, STAND- 
BY BALL SCREW CONTROLS 
OUTPUT FROM ALL CHANNELS 


NO EFFECT 


NO EFFECT 


10 ‘ JAMMED HYDRAU- - CONTAMINATION SAME AS 8 
Lie POV/ER SPOOL 


•STRUCTURAL 

FAILURE 


11 FAILED MOTOR •OPEN COIL 
BRAKE - {LOCKED 
MOTOR) 


1 2 FAILED MOTOR 
BRAKE (WONT 
LOCK) 

HARDOVER SIGNAL 
(2ND FAILURE) 


13 INTERNAL HYDRAU' 
Lie LEAKAGE - 
HIGH FLOW 

14 EXTERNAL HY- 
DRAULIC LEAKAGE 

- high flow 


•JAMMED 

MECHANISM 


SAME AS 3 


NOT DETECTED 


SAME AS 3 


♦PISTON SEAL 
•EROSION/ WEAR 
POWER SPOOL 


NOT DETECTED 


NO EFFECT 


♦BALL SCREW OUTPUT IS -NO EFFECT IF JAM IS «NO EFFECT 

800 LBS, SUFFICIENT TO CLEARED 

SHEAR CONTAMINATION 

♦JAM WOULD NOT CLEAR ONLi •ELEVATOR SERVQACTUATDRS -LOSS OF CONTROL 
IF MASSIVE STRUCTURAL STALLED 

FAILURE OCCURRED •ONE AILERON SERVOACIUATOR *IF FIXED ACTUATOR 

OPERABLE & ONE STALLED. IS NEAR EXTREME 

POSITION - LOSS OF 
CONTROL 


ONE MOTOR LOCKED, FAIL- 
URE DETECTED BY CROSS 
MONITORING. POWER RE- 
MOVED FROM SERVO MOTOR 
AND BRAKE. 


♦SAME AS 3 


•ROD DWAMIC SEAL LOW PRESS WARN- 
•STATIC SEAL TO inG WHEN FLUID 
AMBIENT CUICUIT IS DEPIETFX 


SAME AS 3 


NONE BY ITSELF 


SAME AS 3 


NO EFFECT 


remaining CH^^NELS back SERIOUS DEGRADA- 
DRW2 THRU OPEN. NO OUT- T!ON. LOSS OF 


PUT UNLESS HYD POWER 
SPOOLS' FLOW FORCES & 
CENTERING SPRING FORCE 
LESS THAN MOTOR FIXED 
PHASE REACTING TORQUE,' 

•FLUID HEATING 
♦LOWER LOAD CAPABILITY 
ON ONE CIRCUIT 

SAME AS I 


CONTROL SENSI- 
TIVITY. 


^SAME AS I 


SAMS AS I 
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ASC CONFIGURATION 1 , AljLERQN - ORBITER 


USAGE? 2 PLACES SHEET 1 


ITEM 

FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

EFFECT ON SYSTEM 

BFFECT ON VEHICLE 

FAILURE 

CATEGORY 

1 

LOSS OF ACTIVE 

•FLUID LOSS 

LOW PRESS 

ENGAGE VALVE SHIFTS AT 

ACTIVE CIRCUIT BYPASSED. 

NO DEGRADATION 

III 


HVD. SYSTEM 

•PUMP FAILURE 

WARNING 

LOW PRESS. LOCKOUT VALVE 

FIRST STANDBY ENGAGED 







SHIFTS TO PREVENT RE-EN- 

NO PERFORMANCE DEGRAD- 





, 


CAGE MEN T 

ATION 



Z 

LOSS OF STANDBY 

SAME AS 1 

SAME AS 1 

SHUTOFF BYPASS VALVE IN 

AFFECTED STANDBY CIR- 

NO EFFECT 

ill 


HYD. SYSTEM 



AFFECTED CIRCUIT SHIFTS 

CUIT CANNOT BE ENGAGED 



* 




TO BYPASS. LOCKOUT, SAME 
AS L 




3 

LOSS OF TWO HYD 

SAME AS 1 

SAME AS 1 

SAME AS 2. ENGAGE VALVE 

REMAINING CIRCUIT ENGAG- 

SAME AS 1 

II 


SYSTEMS - ONE 
ACTIVE 



SHIFTS TO NEW POSITION. 

ED. NO PERFORMANCE 
DEGRADATION 



4 

HARDOVER SIGNAL-’ 

•ELECT HARDOVEI 

FAIL INDICATION - 

COMPARATOR SPOOL SHIFTS, 

SAME AS 1, 

SAME AS 1 

in 


ACTIVE OR MON I- 

•PLUGGED NOZZLE 

COMPARATOR 

DUMPING PRESS. ENGAGE 





TOR CHANNEL 

HYD. AMPLIFIER 

SPOOL 

VALVE SHIFTS AT LOW PRESS. 
LOCKOUT, SAME AS 1 



• 

5 

HARDOVER SIGN AD 

SAME AS 4 

SAME AS 4 

COMPARATOR SPOOL SHIFTS, 

FAILED CIRCUIT CANNOT BE 

SAME AS 1 

III 


STANDBY OR 



CYCLING SHUTOFF BYPASS 

ENGAGED. NO CHANGE TO 




MONITOR CHANNEL 



VALVE. LOCKOUT, SAME 1 

ACTIVE CONTROL 



6 

HARDOVER SIGNAL- 

SAME AS 4 

SAME AS 4 

COMPARATOR SPOOL SHIFTS, 

SAME AS 3 

SAME AS 1 

II ^ 


ON FIRST STAND- 



DUMPING PRESS. TO HYD 





BY - (ACTIVE 

• 


CP LING. ENGAGE VALVE 





CHANNEL FAILED) 



SHIFTS AT LOW PRESS LOCK- 
OUT. SAME AS 1 




7 

SUMMING AMPLI- 

•ELECT OPEN 

NOT DETECTED 

NONE 

NONE. BAD SIGNAL BLOCK- 

NO EFFECT 

lU 


FIER - BAD OUT- ; 

•ELECT SHORT 



ED BY VOTERS Et DISEN- 




PUT 

•OPEN FEEDBACK 



GAGED FROM VOIER LOGIC 

. 

' 

8 

SUMMING AMPLI- 

SAME AS 7 

NOT DETECTED 

NONE 

NONE. BAD SIGNAL BLOCK- 

NO EFFECT 

II ' 


FIER-2 FAILED 




ED BY VOTERS 

* 


9* 

JAMMED POWER 

CONTAMINATION 

SAME AS 4 

•SAME AS 4 - IF ACTIVE 

SAME AS 4 IF ACTIVE 

SAME AS 1 

III 


SPOOL 



•SAME AS 5 - IF STANDBY 

SAME AS 5 - IF STANDBY 



10 

FAILED HYDRAUIIC 

• BROKEN 

SAME AS 4 

SAME AS 9 

SAME AS 9 

SAME AS I 

III ■ 


MONITOR 

• BLOCKED RE- 






■ A, 


STRICTOR 


1 

1 


, 

' 
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ASC 


CONFIGURATION I. AILERON - ORBIXER 


SHEET Z 



FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

. EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILURE 

CATEGORY 

U 

JAMMED COMPAR- 
ATOR (INNEUTRAL 

• CONTAMINATION 
\ ♦ BROKEN SPRING 

•NOT DETECTED 

NONE 

NONE BY ITSELF 

NO EFFECT 

III 


HARDOVER SIGNAL 
(2ND FAILURE) 


• NOT DETECTED 

NONE. IF ON ACTIVE CHANNEL 
CREW MUST SWITCH OFF AC- 
TIVE SYSTEM HYD. PRESSURE 

, OUTPUT WILL FOLLOW HARD- 
OVER. OPPOSITE AILERON 
WILL MOVE IN, same ORECHON 

LARGE ROLL 
TRANSIENT. SAME AS 
1 AFTER SV^TCHING 

I 

12 

JAMMED COMPARA- 
TOR SPDOL-END 
POSITION 

. CONTAMINATION 

SAME AS 4 

NONE 

THIS FAILURE IS RESULT OF 
PREVIOUS CHANNEL FAILURE. 
HAS NO EFFECT ON SUB- 
SEQUENT FAILURES 

NO EFFECT 

III 


SOL. LOCKOUT 
VALVE^UCK IN EN- 
ERGIZED POSITION 

SAME AS 12 

NOT DETECTED 

NONE 

NONE BY ITSELF 

NO EFFECT 

m 


ERRmC CHANNEL 

OUTPUT 

(END FAILURE) 


SAME AS 4 

COMPARATOR SPOOL CYCLES 
BETWEEN NEUTRAL END 
POSITION, SHIFIING ENGAGE 
VALVE 

FAILURE MODE OF LOCKOUT 
VALVE CANNOT PREVENT ER- 
RATIC CHANNEL FROM RE- 
ENGAGING 

INTFRMrrrENT 
SWITCHING BETWEE3S 
CHANNELS CAUSE 
UNDESIRABLE BUT 
NOT CATASTEOPIC 
TRANSIENTS 

III 

14 

SOL LOCKOUT 
VALVE - OPEN 

• BROKEN WIRE 
•OPEN COIL 

NOT DETECTED 

NONE IN FLIGHT 

NONE IN FLIGHT. AFFECTED 
CHANNEL OWNOr BE ENGAGED 
during GRD CHECKOUT 

NO EFFECT 

.in 

15 

JAMMED ENGAGE 
VALVE 

• CONTAMINATION 

NOT DETECTED 

NONE 

NONE BY ITSELF j 

NO EFFECT 

HI 

. 

HARDOVER-ACTIVE 
CHANNEL 
(2ND FAILURE) 

* 

SAME AS 4 

NONE 

DEFECTIVE CIRCUIT CANNOT 
BE DISENGAGED. OUTPUT GOES 
HARDOVER. OPP. AILTRON 
MOVES IN S^ME DIRE CHON 

LOSS OF CONTROL 

I 

.16 

failed VOTER- 
BAD OUTPUT 

•ELECT OPEN 
• ELECT SHORT 

SAME AS 4 

SAME AS 4 - IF ACTIVE 
SAME AS 5 - IF STANDBY 

SAME AS 4 - IF ACTIVE 
SAME AS 5 - IF STAJ^DBY 

SAME AS 1 

m . 

17 

INTERNAL LEAK- 
AGE - high RATE 

•PISTON SEAL 
• EROSION/ WEAR 
LAPPED SPOOLS 

NOT DETECTED 

1 

NONE. UNLESS CREW * ’ 

SWITCH TO STANDBY 

• FLUID HEATING 

• LOWER SERVO CAIN 
•LOWER LOAD CAPABILITY 

POSSIBLE REDUC- 
TION IN VEHICLE 
ROLL RESPONSE 
UNTIL CREW 
SWITCHES TO 
STANDBY 

m 

18 

EXTERNAL LEAK- 
AGE-mOH RATE 

•ROD DYNAMIC 
SEAL 

• STATIC SEAL TO 
AMBIENT 

SAME AS 1 

j 

SAME AS 1 

SAlvIE AS 1. POTENTIAL 
SAFETY HAZARD WITH 
OIL SPILLAGE 

1 - 

SAME AS 1 

III 

1 
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A5C CQNFIGUZ^ATION Z. AILE, ^QN > ORDITER 


ITEM FAILURE MODE i PRIMARY CAUSE j DETECTED BY~ 


USAGE: Z PLACES 


FAILURE CORRECTION 


EFFECT ON SYSTEM 


EFFECT ON VEHICLE 


NOTE: SPEED REDl CTION AFTER FAILURE DEPENDS ON CH/NNEL FAILURE DUE TO SUMMl AO ACTION OF DIFFERENTIAL. 

FOR THIS A^ ALYSIS, THE FOLLO YING DEFINITIONS A^PLY FOR ONE AILERON: 

CHANNEL OUTPUT LOCKED MAX, RATE CAPABILITY 
NO. 1 75% 

NO. 2 75% 

NO. 3 50% 

NO. I & 2 50% 

NO. I & 3 ’ ‘ 25% 

No. 2 8c 3 25% 


LOSS OF NO. I 
POWER INPUT - 
ONE AILERON 


LOSS OF NO. 2 
POWER INPUT- _ 
ONE AILERON 

LOSS OF NO. 3 
POWER input- 
one AILERON 

LOSS OF NO. 1 & NO. 
Z POWER INPUT - 
ONE AILERON 


► ELECT OPEN- 
MOTOR 

• JAM OR OPEN 
GEAR BOX 

SAME AS 1 


SAME AS 1 


SAME AS 1 


INPUT TO output DETECTION SWITCHES OFF 
DETECTION INPUT POWER TO AFFECTED 

CLUTCH 


SAME AS 1 


SAME AS 1 


SAME AS 1 


SAME AS 1 


i SAME AS I 


SAME AS 1 


OUTPUT OF CHANNEL NO. 1 VEHICLE ROLL 
LOCKED. SERVOACTUATOR RESPONSE 88% 
OPERATES AT 75% MAX. RATE OF NORMAL MAX, 

SAME AS i EXCEPT CHANNEL SAME AS I 
NO.. 2 LOCKED 

OUTPUT OF CHANNEL NO. 3 VEHICLE ROLL 
LOCKED. SERVOACTUATOR RESPONSE 75% 
operates at 50% MAX. RATE OF NORMAL MAX. 


OUTPUT OF NO. 1 U NO. Z 
LOCKED. SERVOACTUATOR 
operates at 50% MAX. RATE 


SAME AS 3 


FAILURE 

CATEGORY 


LOSS OF NO. 1 OR 
NO. 2 & NO. 3 POWISR 
INPUT-ONE AILERON 

LOSS OF NO. I OR 
NO. 2 POWER INPin 
-BOTH AILERONS 


LOSS OF NO. 1 OR 
NO. 2 -ONE AILE- 
RON 

LOSS OF NO, 3 - 
ONE AILERON 

LOSS OF N0.3 - 
DOTH AILERONS 


SAME AS 1 


SAME AS X 


SAME AS 1 


SAME AS 1 


SAME AS 1 


SAME AS I 


SAME AS X 


SAME AS 1 


SAME AS 1 


SAME AS X 


SAME AS 1 


SAME AS 1 


OUTPUTS OF AFFECTED 
CHANNELS LOCKED. SERVO- 
ACTUATOR operates’'at 
25% MAX, RATE 

OUTPUTS OF AFFECTED 
channels LOCKED.SERVO- 
ACTUATOR operates at 
50% MAX RATE 

SAME AS 5 


VEHICLE ROLL 
RESPONSE 62. 5% 
OF NORMAL MAX 


SAME AS 3 


SAME AS 5 


EACH SERVOACTUATOR VEHICLE ROLL RE- 

OPERATES AT 50% MAX. RATE SFONSE 50% OF NOR- 
MAL MAX 
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ASC CONFIGURATION 2. AILERON - ORBITER 


FAILURE MODE 


HARDOVER SIGNAL 


PRIMARY CAUSE 


DETECTED BY 


FAILURE CORRECTION 


•ELECT HARDOVERl FAULT INDICATION 
♦ELECT OPEN - ELECTRONIC 

•OPEN FEEDBACK VOTER & AVERAGER 


FAULT INDICATION FAULTY SERVO AMPLIFIER 
- ELECTRONIC CHANNEL SWITCTIED OFF 


EFFECT ON SYSTEM 


3 CHANNELS STILL AVAIL- 
ABLE FOR FAULT DETEC- 
TION 


EFFECT ON VEHICLE 


I NO EFFECT 


FAILURE 

CATEGORY 


ill 


HARDOVER SIGNAL 
^ONBCK^^INSLOFl 


SAME AS 9 


SAME AS 9 


SAME AS 9 


^ REMAINING CHANNELS IN 
CONTROL. CANNOT SUSTAIN 
ANOTHER LIKE FAILURE 


NO EFFECT 


ONE SOLENOID - 
STUCK IN ENER- 
GIZED POSITION 
OR OPEN 


•CONTAMINATION SAME AS I 
•MECH. JAM I 
♦ELECT OPEN 


SAME AS 1 


WORST CASE -SAME AS 3 


SAME AS 3 


SPRING CLUTH - 
JAMMED 


•BEARING 

FAILUI^E 


SAME AS 1 


SAME AS 1 


WORST CASE - SAME AS 3 


SAME AS 3 


SPRING CLUTCH - 
OPEN 


•BROIdiN SPRING SAME AS 1 


SAME AS I 


NO OUTPUT FROM DIFFER- 
ENTIAL IN ONE DIRECTION. 


SERIOUS DEGRADA- 
TION, ONE AILERON 


Z GOOD SYS. BACKDRIVE THE DISCONNECTED IN 


DISCONNECTED SHAFT 


ONE DIRECTION. 

I ROLL RESPONSE 
I 50% OF NORMAL IN 
I ONE DIRECTION & 

‘ 73% IN OPP, DIREC- 
' TION 


LOSS OF detec- 
tion FEEDJ^ACK 

JAMMED OUTPUT 


. ♦ELECT OPEN 


•DIFFERENTIAL 1 
BEARING SEI- . 
ZURE, STRUCT. 
FAILURE 

♦OUTFUT ACIUAIOR 
CONTAMINATION 
BEARING SEI- 
ZURE 

STRUCT. FAILURE 


SAME AS 1 


SAME AS 1 


SAME AS 1 


DETECTION SWITCHES OFF 
INPUT POWER TO ALL 
CLUTCHES 


WORST CASE - SAME AS 3 SAME AS 3 . 


NO OUTPUT FROM DIFFER- 
ENTIAL. AILERON JAMMED. 


•IF JAM IS AT TRAIL, 
VEHICLE ROLL RE- 
SPONSE 50% OF 
NORMAL 
•IF JAM IS AT OR 
NEAR EXTREIvlE ' 
AILERON POSITION, 
LOSS OF CONTROL 


NOTE: WITH SELPi MONITORING {INTRy -CHANNEL), SURFACE HINGE MOMENT SATURATION OR SURFACE AGAINST THE sioPS FOR A 

PERIOD EjjCEEDING DETECTIOU TIME DELAY WILL CAUSE MASSIVE SHUTDOWN AS ^ HOWN IN ITEM 16. ADDITIONAL CIRCUITRY 
MUST BE E^TRODUCED TO PRE ;ENT THIS OR RELIANCE MUST REST ON RESET OF NPUT POWER BY CREW, j 
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TVC 


CONFIGURATION 1, BOOSTER AND ORBITER 


USAGE; 2 PLACES - PITCH AND YAW 


SHEET 1 


ITEM 

failure mode 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILURE 

CATEGORY 

1 

LOSS OF ACTIVE 

♦ FLUID LOSS 

LOW PRESS 

ENGAGE VALVE SHIFTS AT 

ACTIVE CIRCUIT BYPASSED. 

NO DEGRADATION 

HI 


HYD, SYSTEM 

♦ PUMP FAILURE 

WARNING 

LOW PRESS. LOCKOUT VALVE 

STANDBY ENGAGED. NO 







SHIFTS TO PREVENT RE-ENGAGE 
MENT. 

PERFORMANCE DEGRADATION 



z 

LOSS OF STANDBY 

SAME AS 1 

SAME AS 1 

SHUTOFF & BYPASS VALVE IN 

standby CIRCUIT CANNOT 

NO EFFECT 

lU 


HYD. SYSTEM 



STANDBY CIRCUIT SHIFTS TO 
BYPASS. LOCKOUT, SAME AS 1. 

BE ENGAGED 



3 

LOSS OF TWO 

SAME AS 1 < 

SAME AS 1 

AFTER 2ND FAILURE, BOTH 

• 1 TVC CENTERED ON 

♦ORBITER CONTROL 

II 


HYD SYSTEMS 



CIRCUITS bypassed. CENTER- 

OR BITER 

LED BY REMAINING 






ING CURCUIT SWITCHED IN. 

♦ 2 TVC SUBSYSTEMS CENT- 

TVC. PERFORM/«4CE 






LOCKOUT, SAME AS 1 

ERED ON BOOSTER 

DEGRADED 
•BOOSTER CONTROL 
ED BY 9 REMAINING 
TVC. PERFORMANCE 
DEGRADED 

II 

4 

LOSS OF CENTER- 

(ACCUMULATOR FEC 







ING SYSTEM 

BY APU HYD.CIR- 
CUIT) 

♦ LOSS OF GAS 

NONE 

NONE 

NONE BY ITSELF 

NO EFFECT 

III 


' 

PRESS 

♦ FLUID LEAK TO 

SAME AS 1 

DEPENDING ON CIRCUIT LOSS, 

SAME AS 1 OR 2 

SAME AS 1 OR 2 

II 

i 

1 

AMBIENT 1 


VALVES SHIFT PER 1 OR 2 | 


1 



LOSS OF REMAIN- 

SAME AS 1 

SAME AS 1 

AFTER 2ND FAILURE, BOTH ' 

• 1 TVC INOPERATIVE ON 

•FO.SSIBLE LOSS OF i 

I 


ING HYD CIRCUIT 



CIRCUITS BYPASSED 1 

ORBITER - CANT CENTER 

CONTL ON ORBITER 



(2ND FAILURE) 



. 

• 2 TVC INOPERATIVE ON 

♦POSSIBLE COLLI- 

I , 




' 


BOOSTER - CANT CENTER 

SION OF ADJACENT 
ENGINES-BOOSTER 


5 


♦ ELECT HARDOVER 

FAIL INDICATION - 

COMPARATOR SPOOL SHIFTS, 

‘ SAME AS 1. 

SAME AS X 

III 


-ACTIVE OR MONI- 

• PLUGGED NOZZLE 

COMPARATOR 

DUMPING PRESS. ENCAGE 


i 



TOR CHANNEL 

♦OPEN FEEDBACK 

SPOOL 

VALVE SHIFTS AT LOW PRESR 
LOCKOUT, SAME AS 1. 


j 


6 


SAME AS 5 

SAME AS 5 

COMPARATOR SPOOL SHIFTS, 

SAME AS 2 

!no effect 

III 





CYCLING SHUTOFF & BYPASS 


1 

! 






VALVE. LOCKOUT SAME AS 1 




7 


SAME AS 5 

SAME AS 5 

SAME AS 3 

SAME AS 3 

SAME AS 3 

1 

II 

8 


contamination 

SAME AS 5 

SAME AS 5 

SAME AS 1 

1 SAME AS 1 

III 


R 
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TVC 


CONFIGURATION I» - BOOSTER AND ORBITER 


■ 


PRIMARY CAUSE 

DETECTED BY 

9 

POWER SPOOL. JAM- 
STANDBY OR MONI- 
TOR 

SAME AS 8 

SAME AS 5 

10 

COMPARATOR SPOOL 
JAM - NEUTRAL. 
ACTIVE CHANNEL 

♦CONTAMINATION 
♦BROKEN SPRING 

NOT DETECTED 


HARDOVER SIGNAL- 
ACTIVE CHANNEL 
(2ND FAILURE) 


NOT DETECTED 

11 

COMPARATOR SPOOL 
JAM - NEUTRAL - 
STANDBY CHANNEL 

SAME AS 10 

SAME AS 10 


HARDOVER SIGNAL 
ACTIVE OR STAND- 
BY (2ND FAILURE) 

" 

SAME AS 5 - ACTIVE 
NOT DETECTED - 
STANDBY 

IZ 

COMPARATOR SPOOL 
JAM-END POSITION 

SAME AS 10 

SAME AS 5 ** 

13 

SOL. LOCKOUT 
VALVE-STUCK IN 
ENERGIEED POSI- 
TION 

CONTAMINATION 

NOT DETECTED 

14 

SOL. LOCKOUT 
VALVE - OPEN 

•BROKEN WIRE 
•OPEN COIL 

NOT DETECTED 

15 

ENGAGE VALVE JAM 

CONTAMINATION 

NOT DETECTED 


HARDOVER SIGNAL- 
ACTIVE CHANNEL 
(2ND FAILURE) 

” 

SAME AS 5 

16 

INTERNAL LEAKAGE 
- HIGH RATE 

♦ PISTON SEAL 
♦EROSION/V/EAR 
LAPPED SPOOLS 

NOT DETECTED 

17 

L, 

EXTERNAL LEAK- 
AGE - HIGH RATE 

•ROD DYN* SEAL 
STATIC SEAL TO 
AMBIENT 

SAME AS 1 


SHEE 


FAILURE CORRECTION 

EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILU 

CATEG 

SAME AS 6 

SAME AS Z 

NO EFFECT 

m 

NONE 

NONE BY ITSELF 

NO EFFECT 

III 

NONE 

•OUTPUT FOLLOWS COMMAND. 

•LOSS OF CONTROL 

I 

• 

REMAINING TVC CORRECTS 

• POSSIBLE COLLI- 



ERROR. MINIMUM CONTROL 

SION OF ADJACENT 
ENGINES -BOOSTER 


NONE 

NONE 

NO EFFECT 

m 

SAME AS 5 - ir ACTIVE 

SAME AS 5 - IF ACTIVE 

SAME AS 1 

in 

NONE - IF STANDBY 

NONE - IF STANDBY 

NO EFFECT 

Hi 

NONE 

THIS FAILURE RESULT OF PRE- 
VIOUS CHANNEL FAILURE. HAS 
NO EFFECT-ON SUBSEQUENT 
FAILURES 

NO EFFECT 

m 

NONE 

NONE BY ITSELF, CANNOT 

NO EFFECT UNLESS 

in 

, 

PREVENT ERRATIC CH>\NNSL 

NUISANCE TRIPPING 



FROM RE-ENGAGING 

OCCURS - TflEN 
TRANSIENT SWntHING 


NONE IN FLIGHT 

NONE IN FLIGHT. AFFECTED 
CHANNEL CANNOT BE RE^EN- » 
GAGED DURING GRD. CHECICOUT 

NO EFFECT 

IH 

NONE 

NONE BY ITSELF 

NO EFFECT 

ni 

NONE. STANDBY CAN'T BE* 

OUTPUT FOLLOWS COMMAND 

•LOSS OF CONTROL 

I 

SWITCHED IN 

REMAINING TVC'S CORRECT 

ON ORBITER 



ERROR. 

•ADJACENT ENGINE 

1 


• 

COLLISION-BOOSTER 


NONE 

* 

•FLUID HEATING 

•REDUCED VEHICLE 

in 


♦ LOWER SERVO GAIN 

; RESPONSE-ORBITER 



•LOWER LOAD CAPABILITY 

'•NO DEGRADATION- 


• 


BOOSTER 


SAME AS 1 -IF ACTIVE CIRCUH 

SAME AS 1 OR 2. 

• SAME AS 1 OR 2 

m 

SAME AS 2 - IF STANDBY 

POTENTIAL SAFETY HAZARD 
WITH OIL SPILLAGE 
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m 




ITEM 

failure mode 

PRIMARY CAUSE 

DETECTED BY 

1 

LOSS OF ONE 
HYD. CIRCUIT 

• FLUID LOSS 

• PUMP LOSS 

•LOW PRESS WARN- 
ING 

• FAULT INDICATION 
-DETECTION & 
SWITCHING LOGIC 

2 

LOSS OF BOTH 
ACTIVE HYD 
S'B TEMs 

SAME AS 1 

SAME AS 1 

3 

LOSS OF STANDBY 
HYD SYSTEM 

SAME ASl 

SAME AS 1 


HARDOVER SIGNAL 

• LOSS OF SIGNAL 
♦ELECT. HARDOVER 

• OPEN FEEDBACK 

• PLUGGED NOZZLE 

FAULT INDICATIO^ 
-DETECTION & 
SWITCHING LOGIC 

5 

HARDOVER SIGNAL 
WITH ONE CHANNElJ 
DE-ACTIVATED 

SAME AS 4 

SAME AS 4 

6 

JAMMED BYPASS 
SPOOL (WONT BY- 
PA SS) 

'•CONTAMINATION 
•BROKEN SPRING 

NOT DETECTED 

1 

HARDCA^R SIGNAL 
(2ND FAILURE) 


SAME AS 4 

7 

JAMMED SECON- , 
DARY ACTUATOR 

CONTAMINATION 

NOT DETECTED 




STRUCTURAL 

FAILURE 


NOT DETECTED 


j 2 PLACES - PITCH AND YAW 


SHEET 1 


FAILURE CORRECTION EFFECT ON SYSTEM EFFECT ON VEHICLE 

PASSIVE FAILURE DETECTED STANDBY CIRCUIT SWITCHEC NO DEGRADATION 
BY CROSS MONITORING, SHUT INTO POWER ACTUATOR, 

OFF VALVE DE-ENERGIZED. PASSIVE SECONDARY ACTU- 
SECONDARY ACTUATOR BY- ATOR DRIVEN BY 2 GOOD 
PASSED. CHANNELS. 



ALL CHANNELS BYPASSED. STDBY CIRCUIT SWITCHED ORBITER CONTROL- II 

SEC. ACTUATORS CENTER. INTO POWER ACTUATOR. LED BY REMAINING 

POWER ACTUATOR CENT- | TVC. PERFORMANCE 
ERED Sc LOCKED j DEGRADED 


SAME AS 1 PASSIVE SECONDARY ACTU- SAME AS 1 III 

ATOR DRIVEN BY 2 GOOD 
CHANNELS. NO CHANGE IN 
OUTPUT 


ACTIVE FAILURE DETECTED PASSIVE SECONDARY ACT- SAME AS 1 III 

• BY CROSS MONITORING. SHUT- UATOR DRIVEN BY 2 GOOD 
OFF VALVE DE-ENERGIZED. CHANNELS 
SEC. ACTUATOR BYPASSED 


SAME AS 2 SAME AS Z, EXCEPT ACTIVE SAxME AS 2 II 

HYD CIRCUITS CENTER THE 
POWER ACTUATOR 


NONE BY ITSELF 


NO EFFECT 


DETECTION SIGNAL DE- 
ENERGIZES SHUTOFF. SEC. 
ACTUATOR WONT BYPASS 


•EACH SEC, ACTUATOR HAS 
APPROX 400 LBS NET FORCE 
TO SHEAR CONTALUNATE OR 
1200 LBS TOTAL. 

•JAM WOULD NOT CLEAR 
ONLY IF MASSIVE STRUC- 
TURAL FAILURE OCCURRED 


2 GOOD CHANNELS OVER- 
. POWER FAILED CHANNEL. 
LOSS IN SERVO GAIN, 
RESPONSE 

• NO EFFECT IF JAM IS 
CLEARED . 


♦SERVOACTUATOR CANT 
FOLLOW COMMAND. RE- 
MAINING TVC CORRECTS 
ERROR 


DEGRADATION IN il 

TVC CONTROL 
SENSITIVITY 


NO EFFECT j III 


possible LOSS OF , I 
CONTROL- DEPEND- 
ENT ON JAM POSI- 
TION 
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TVC CONFIGURATION 2, - ORBITER 


ITEM 

FAlLUrUI MODE 

PRIMARY CAUSE 

DETECTED BY 

8 

MAIN SPOOL-JAM 

SAME AS 7 

SAME AS 7 

9 

DETECTION U 
SWITCHING LOGIC 
ONE OPEN 

BROKEN OR OPEN 
CONNECTION 

SAME AS 4 

10 

SOL SHUTOFF 
VALVE - STUCK IN 
ENERGIZED POSI- 
TION 

CONTAMINATION 

SAME AS 6 

11 

SOL SHUTOFF - 
VALVE - OPEN 

BROKEN OR OPEN 
CONNECTION 

SAME AS 4 

12 

CONTROL MIS- 
MATCH - PRESS, 
VOLTAGE, GAIN 
RESPONSE 


NOT DETECTED UN- 
LESS MISMATCHES 
REACH FAILURE 
DETECTION THRES- 
HOLD 

(NUISANCE TRIP) 

15 

INTERNAL LEAK- 
AGE - HIGH RATE 

• FAILED seal ACIU 
ATOR PISTONS 

• EROSION/ WEAR 
LAPPED SPOOLS 
NOZZLE 

■ NOT DETECTED 
UNLESS CHANNEL 
PERFORMANCE 
DEGRADED TO FAIL- 
URE THRESHOLD 

14 

EXTERNAL LEAK- 
AGE*- HIGH RATE 

•ROD DYNAMIC SEAL 
•STATIC SEAL TO 
! AMBIENT 

LOW PRESS WARN- 
ING WHEN FLUID 
CIRCUIT IS DEPLETED 

15 

SWITCHING VALVE 
- INTERSYSTEM 
LEAKAGE 

• EROSION/ WEAR 
•SEAL 

SAME AS 1 


1 LOSS OF HYD CIR- 
i CUIT {2ND FAILURE] 


SAMS AS 1 

16 

i SWITCHING VALVE- 
JAMMED, NORMAL 
POSITION 

CONTAMINATION 

NOT DETECTED 

L 

LOSS OF ACTIVE 
HYD. CIRCUIT 
(2ND FAILURE) 

i 

• 

SAME AS 1 


FAILURE CORRECTION 


SAME AS 7 


SAME AS 4 


EFFECT ON SYSTEM 


SAME AS 7 
SAME AS 4 


EFFECT ON VEHICLE 


SAME AS 7 


SAME AS 1 


SliEET 2 


FAILURE 

CATEGORY 


SAME AS 6 


SAME AS 6 


SAME AS 6 


SAME AS 1 


SAME AS 4 


SAME AS 1 


NONE UNTIL FAILURE THRES- 
HOLD IS REACHED, THEN 
RESULT IS SAME AS 4 


EQUALIZING CIRCUITS BE- 
TWEEN CHANNELS PROVIDE 
AVERAGING BIAS SIGNALS TO 
EACH SERVO AMP TO FORCE 
ALL channels TO A COM_ 
MON NULL. 


NO EFFECT 


NONE UNTIL FAILURE 
THRESHOLD IS REACHED, 
THEN RESULT IS SAME AS 4 


•FLUID HEATING 
« LOWER SERVO GAIN 
» LOWER LOAD CAPABILITY 
ON ONE CIRCUIT 


SAME AS 1 


SECONDARY ACTUATOR 


SAME AS 1. POTENTIAL 
SAFETY HAZARD EXISTS 
WITH OIL SPILLAGE 


SAME AS 1 


SAME AS I 


SAME AS 2 


FLUID FROM ONE SYSTEM 
LOST THRU LOW PRESS RE- 
LIEF OF 2ND SYSTEM. 
EFFECT SLMILAR TO ITEM 1 

ACTUATOR CENTERED BY 
REMAINING HYD. CIRCUIT 

NONE BY ITSELF 


SAME AS I 


SAME AS 2 


NO EFFECT 


SAME AS I 


STANDBY CIRCUIT CAN’T 
SWITCH IN. POWER ACTUATOR 
DRIVEN BY GOOD CIRCUIT 


NO EFFECT 
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7 VC CONFIGURATION 3, ORBITER ' USAGE i 2 PLACES - PITCH AND YAW SHEET 1 


ITEM 

FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

1 

• EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILURE 

CATEGORY 

1 

LOSS OF ONE 
HYD SYSTEM 

•FLUID LOSS 
•PUMP FAILURE 

•LOW PRESS WARN- 
ING 

♦ FAULT INDICATION 
-DETECTION & 
SWITCHING LOGIC 

PASSIVE FAILURE DEIECXED 
BY CROSS MONITORING. SHUT 
OFF VALVE DE-ENERGIZED. 
SECONDARY ACTUATOR CEm 
ERED ^ LOCKED 

INNER LOOP GAIN & OUTPUT 
RATE ON SERVOACTUATOR 
REDUCED 50%. OUTPUT CIR- 
• CUIT TO POWER ACTUATOR 
BYPASSED 

VEHICLE RESPONSE 
LOWERED IN ONE 
PLANE 25% 

in 

2 

LOSS OF BOTH 
ACTIVE HYD SYS. 

SAME AS 1 

SAME AS 1 

ALL SHUTOFF VALVES DE- 
ENERGIZED. SEC. ACTUATORS 
CENTER h LOCK. CENTERING 
VALVE OPENS 

NO CONTROL OUTPUT. 
CENTERING ACTUATOR 
CENTERS LOCKS TVC 

ORBITER CON- 
TROLLED BY RE- 
MAINING TVC. PER- 
FORMANCE DE- 
GRADED 

II 

3 

LOSS OF CENTER- 
ING HYD SYSTEM 

SAME AS 1 

SAME AS 1 

MONITOR CHANNEL SHUTOFF 
SBODNDARY ACTUATOR CENIEREE 

- NO EFFECT 

NO EFFECT 

II 


FAILED CHANN&L 
OR HYD CIRCUIT 
(2ND FAILURE) 


SAME AS I 

ACTIVE CHANNELS SHUTOFF^ 
ALL SEC. ACTUATORS 
CENTERED & LOCKED 

SERVOACTUATOR BYPASSED. 
’ POSITION CONTROLLED BY 
LOAD. REMAINING TVC COR- 
RECTS ERROR 

POSSIBLE LOSS OF 

control 

I 

4 

HARDOVER SIGNAL^ 
ACTIVE CHANNEL 

•ELECT HARDOVER 

♦ ELECT OPEN 

♦ PLUGGED NOZZL 

♦ OPEN FEEDBACK 

FAULT INDICATiO^ 
-DETECTION 
: SWITCHING LOGIC 

ACTIVE CHANNEL SHUTOFF. 
SECONDARY ACTUATOR 
CENTERED & LOCKED 

SAME AS *I 

SAME AS 1 

HI 

5 

HARDOVER SIGNAL 
WITH ONE CHAN- 
NEL OFF 

SAME AS 4 

SAME AS 4 

.SAME AS 2 

SAME AS 2 

SAME AS 2 

II 

6 

JAMMED BYPASS- 
SECONDARY ACT- 
UATOR(WONT BY- 
PASS} 

CONTAMINATION 

NOT DETECTED 

NONE 

NONE BY ITSELF 

NO EFFECT 

m 


HARDC3VER SIGNAL 
(2ND FAILURE) 

. 

SAMLE AS 4 

CHANNEL SHUTOFF. SECON- . 
DARY ACTUATOR WONT 
CENTER, remaining ACTIVE 
SECONDARY GOES HARDOVER 
IN OPP DIRECTION 

• OUTPUT WILL RESPOND TO 
COMMAND IN ONE DIREC- 
TION only 

UNSYMMETRICAL 
VEHICLE RESPONSE 

II 

7 

JAMMED BYPASS- 
POWER ACTUATOR 
(WONT BYPASS) 

CONTAMINATION 

NOT DETECTED 

NONE 

NONE 

NO EFFECT 

j 

III 

L. 

hardover signal 

(2ND FAILURE) 


SAME AS 4 

SAME AS 4 

SAME AS i EXCEPT POWER 
ACTUATOR WONT BYPASS 

NO EFFECT 

m 

1 
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TVC 


SHEET 2 


ITEM 

FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

PAILURE CORRECTION 

EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILURE 

CATEGORY 

8 

SSCONDAKY ACT- 

♦STRUCTURAL 

SAME AS 4 

ACTIVE CHANNEL SHUTOFF- 

INNER LOOP GAIN & OUTPUT 

UNSYMMETRICAL 

11 


UATOR JAM - AC- 

FAILURE 


SECONDARY ACTUATOR 

RATE REDUCED IN DIREC- 

VEHICLE RESPONSE 



txve channel 



WONT CENTER 

TION OPP. JAM 





* CONTAMINATION 

NOT DETECTED 

EACH SEC. ACTUATOR HAS 

NO EFFECT IF JAM IS CLEAR 

NO EFFECT 

m 





SUFFICIENT FORCE TO SHEAR 

ED WITHIN FAILURE DETEC- 







CONTAMINANT 

TION(POSITION) THRESHOLD 



9 

JAMMED POWER 

• STRUCTURAL 

SAME AS 4 

MONITOR CHANNEL SHUTOFF. 

SERVO ACTUATOR FIXED. 

LOSS OF CONTROL 

I 


SPOOL 

FAILURE 


SEC. ACTUATOR CENTERS 

REMAINING TVC CORRECTS 

IF JAM OCCURRED 







ERROR 

AT ACTUATOR EX- 








TREME POSITION 

* 



• CONTAMINATION 

NOT DETECTED 

each SEC. ACTUATOR HAS 

NO EFFECT IF JAM IS 

NO EFFECT 

ni 





SUFFICIENT FORCE TO SHEAR 

CLEARED 





- 


CONTAMINANT 




10 

DETECTION AND 

BROKEN OR OPEN 

SAME AS 4 

SAME AS 4 

SAME AS \ 

SAME AS 1 

m 


SWITCHING LOGIC- 

CONNECTION 







ONE OPEN 







u 

SOL SHUTOFF - 

CONTAMINATION 

NOT DETECTED ^ 

NONE 

NONE 

NO EFFECT 

m 


STUCK IN ENER^ 








GIZED POSITION 



' 





HARDOVER SIGNAL 

_ 

SAME AS 4 

SAME AS 6- 

SAME AS 6 

SAME AS 6 

u 


{2ND FAILURE) 


> 





* 

SOL SHUTOFF - 

•BROKEN OR OPEN 

SAME AS 4 

SAME AS 4 


SAME AS 1 

m 


OPEN 

CONNECTION 



SAME AS I j 



13 

INTERNAL LEAK- 

•FAILED SEAL i 

NOT DETECTED 

NONE UNTIL FAILURE 

•FLUID HEATING ! 

NO DEGRADATION 

ni 


AGE -HIGH RATE 

•ACTUATOR PIS- . ! 

UNLESS CHANNEL 

THRESHOLD IS REACHED, 

•LOWER SERVO GAIN 

UNLESS ONE 




TONS . 1 

PERFORMANCE 

THEN RESULT IS SAME AS 4 

•LOWER LOAD CAPABILITY 

CHANNEL SHUTDF:^ 


! 


•EROSION/WEAR | 

DEGRADED TO 


ON ONE CIRCUIT 

THEN SAME AS 1 




LAPPED SPOOLS | 

FAILURE THRES- 







NOZZLE j 

HOLD 

• 



• - 

14 

EXTERNAL LEAK- 

•ROD DYNAMIC 

SAME AS 1 WHEN 

SAME AS 1 

SAME AS 1. POTENTIAL 

SAME AS 1 

III 


AGE-HIGH RATE 

SEAL 

FLUID CIRCUIT IS 


SAFETY HAZARD EXISTS 1 





•STATIC SEAL TO ; 

DEPLETED. j 

* 

WITH OIL SPILLAGE 




! 

1 

AMBIENT i 

* 
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TVC CONFIGURATION 2 - BOOSTER 


SHEET 2 
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TVC 


CONFIGURATION 3 - BOOSTER 


USAGE: Z PLACES - PITCH AND YAW 


SHEET 1 


ITEM 

FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

EFFECT ON SYSTEM 

effect on VEHICLE 

ISBIll 

1 

LOSS OF ACTIVE 
HYD SYSTEM 

♦ FLUID LOSS 

• PUMP FAILURE 

•LOW PRESS 
WARNING 

•FAULT INDICATION- 

comparator 

SHUTOFF h BYPASS VALVE 
SHIFTS AT LOW PRESS. SECON- 
DARY ACTUATOR CENTERS. 
CENTERING VALVE OPENS 

POWER ACTUATOR CENTEREC 
BY CENTERING CIRCUIT U 
LOCKED 

VEHICLE control- 
led BY REMAINING 
TVC SUBSYSTEMS. 
SMALL DEGRADA- 
TION IN VEHICLE 
RESPONSE 

III 

Z 


SAME AS 1 

SAME AS 1 

SAME AS 1 

POWER ACTUATOR CENTERED 
BY ACTr\'E CIRCUIT. LOCK 
DOES NOT ENGAGE 

SAME AS 1 

IR 

3 

HARDOVER SIGNAL 
ACTIVE OR MONI- 
TOR CHANNEL 

• ELECT HARDOVER 

• ELECT OPEN 
•PLUGGED NOZZLE 

• OPEN FEEDBACK 

FAULT INDICATION- 
COMPARATOR 

COMPARATOR SPOOL SHIFTS, 
DUMPING PRESS TO BYPASS. 
SECONDARY ACTUATOR 
CENTERS, CENTERING VALVE 
OPENS . 

SAME AS I 

SAME AS 1 

III 

4 


CONTAMINATION 

SAME AS 3 

SAME AS 3 

SAME AS 1 

SAME AS i 

■" 

5 

JAMMED BYPASS 
VALVE {WONT 
BYPASS) 

•CONTAMINATION 
• BROKEN SPRING 

NOT DETECTED 

1 

i 

NONE 

NONE BY ITSELF 

NO EFFECT 

II 

j 

HARDOVER SIGNAL 
{2ND FAILURE) 

' 

SAME AS 3 ! 

! 

COMPARATOR SPOOL SHIFTS, ' 
DUMPING PRESS TO BYPASS, ‘ 
SECONDARY ACTUATOR CANT 
CENTER. CENTERING VALVE 
OPENS 

OUTPUT FOLLOWS COMM/^D 
HARDOVER 

: COLLISION OF AD- i 
JACENT ENGINES 

. i 

I , 

6 

! 

FAILED HYDRAUUC 
MONITOR 

•BROKEN FLAPPER 

• EXCESSIVE WEAR 

• BLOCKED RESTRK 
TOR 

SAME AS 3 

SAME AS 3 

SAME AS 1 

SAMS AS 1 

1 

1 

] 

m 

. 

1 


SAME AS 3 

NOT DETECTED 

NONE 

NONE BY ITSELF, 

1 

1 

NO EFFECT 

II 

1 



NOT DETECTED 

NONE i 

OUTPUT FOLLOVrS COM- | 

MAND HARDOVER ! 

COLLISION OF 

ADJACENT 

ENGINES 

i 

X • 
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TVC CONFIGURATION 3 - BOOSTER 


SHEET Z 


ITEM 

failure mode 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

— - 

EFFECT ON SYSTEM 

effect on vehicle 

8 

JAMMED COM- 
PARATOR SPOOL- 
END POSITION 

SAME AS 5 

SAME AS 3 
% 

NONE 

THIS FAILURE RESULT OF 
PREVIOUS FAILURE . HAS NO 
EFFECT SINCE POWER ACTUA 
TOR IS CENTERED LOCKED 

NO EFFECT 

9 

JAMMED SECON- 
DARY ACTUATOR 

•CONTAMINATION 

NOT DETECTED 

^SECONDARY ACTUATOR HAS 
SUFFICIENT FORCE TO 
SHEAR CONTAMINANT 

NONE 

NO EFFECT 



•STRUCTURAL 

FAILURE 

NOT DETECTED 

►JAM WOULD NOT CLEAR 
ONLY IF MASSIVE STRUC- 
TURAL FAILURE OCCURRED 

SERVOACTUATOR CANT 
FOLLOW COMMAND 

POSSIBLE COLLI- 
SION OF ADJACENT 
ENGINES 

10 

SOL LOCKOUT 
VALVE -FAILED 
OPEN 

•BROKEN OR OPEN 
CONNECTION 

NOT DETECTED 

NONE IN FLIGHT 

NONE IN FLIGHT. CONTROL 
CANNOT BE RE-ENGAGED 
DURING GROUND CHECKOUT 

SAME AS 1 

I 1 

SOL LOCKOUT 
VALVE - STUCK IN 
ENERGIZED POSI- 
TION 

CONTAMINATION 

NOT DETECTED 

NONE 

NONE BY ITSELF^ CANNOT 
PREVENT ERRATIC CHANNEL 
FROM RE-ENGAGING 

NO EFFECT UNLESS 
NUISANCE TRIPPING 
OCCURS - THEN 
TRANSIENT SWITCH- 
ING 

12 

CENTERING VALVF 
- FAIL OPEN OR 
INTERNAL LEAK- 
AGE 

• FAILED SEAL 
•EROSION/ WEAR 
LAPPED SPOOL 

NOT DETECTED 

jNONE 

•FLUID HEATING 

NO EFFECT 

13 

INTERNAL LEAK- 
AGE - HIGH RATE 

SAME AS 12 

NOT DETECTED 

NONE 

►FLUID HEATING 
•'LOWER SERVO GAIN 
►LOWER LOAD CAPABILITY 

►NEGLIGIBLE 

DEGRADATION 

14 

EXTERNAL LEAK- 
AGE -HIGH FLOW 

•ROD DYNAMIC 
SEAL 

• ANY STATIC SEAL 
TO AMBIENT 

SAME AS 1 

SAME AS 1 

i 

1 

SAME AS 1 

i 

'SAME AS 1 

f 

1 , 


FAILURE 

CATEGORY 


in 


UI 


I 


m 


m 


m 


m 


UI 


j 










5-22 


ASC DIGITAL CONFIGURATION - AILERON • ORBITER 


B 

failure mode 

PRIMARY CAUSE 

DETECTED BY 

1 

LOSS OF ONE HYD 
SYSTEM 

♦FLUID LOSS 
•PUMP FAILURE 

•LOW PRESS 
WARNING 

z 

LOSS OF TWO HYD 
SYSTEMS 

SAME AS 1 

SAME AS I 

3 

HARDOVER INPUT 

♦SHORTED SWITCH 
♦ JAMMED TORQUE 
MOTOR ARMATURI 
-JAMMED PILOT 
STAGE SPOOL 

FAULT INDICATION 

-OVERPRESSURE 

SENSOR 

4 

2 HARDOVERS 

SAME AS 3 

SAME AS 3 

5 

LOSS OF CHANNEL 
OUTPUT 

•LOSS OF SIGNAL 
♦BROKEN WIRE 

SAME AS 3 

6 

JAMMED DIGITIZER 
SPOOL - ANY 
POSITION ' 

CONTAMINATION 

SAME AS 3 

7 

JAMMED POWER \ 
SPOOL-BLOCK- ' 

ING POSITION . 

i 

CONTAMINATION 

SAME AS 3 

8 

JAMMED POWER , 
SPOOL-END POSI- ' 
TION 

CONTAMINATION 

SAME AS 3 

9 

30 L SHUTOFF - 
FAILED OPEN 

BROKEN OR OPEN 
CONNECTION 

NOT DETECTED 
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PIGIT;\L configuration ■» AILERON - ORBITER 


SHEET 2 


■ 

FAILURE MODE 

PRIMARY CAUSE 

DETECTED BY 

FAILURE CORRECTION 

- 

EFFECT ON SYSTEM 

EFFECT ON VEHICLE 

FAILURE 

CATEGORY 

10 

JAMIMED PIJLOT 
SPOOL- NEUTRAL 

CONTAMINATION 

SAME AS 3 

SAME AS 6 

SA2^ AS 1 

SAME AS 1 

m 

11 

JAMMED PILOT 
SPOOL- end 
POSITION 

CONTAMINATION 

SAME AS 3 

SAME AS 3 

SAME AS 1 

SAME AS 1 

m 

12 

SOL SHUTOFF - 
STUCK, IN ENER- 
GIZER POSITION 

CONTAMINATION 

NOT DETECTED 

NONE 

NONE BY ITSELF 

NO EFFECT 

III 


HARDOVER SIGNAL 
(2ND FAILURE) 


SAME AS S 

OVERPRESSURE RELIEF 
OPERATES WHEN ACTUATOR 
IS DRIVEN BY GOOD CIRCUITS, 
.ACTUATOR CANT BE BYPASS- 
ED 

67% HINGE MOMENT CAPA- 
BILITY. REDUCTION IN 
STIFFNESS 

SAME AS 2 

II 

13 

INTERNAL LEAK- 
AGE - HIGH RATE 

•FAILED SEAL 
ACTUATOR PIS- 
TON 

•EROSION /WEAR 
POWER SPOOL 

NOT DETECTED 

NONE 

ONE CIRCUIT LOSES 
EFFECTIVE STIFFNESS. 
SURFACE POSITION HELD BY 
REMAINING CIRCUITS 

SAME AS 1 

III 

14 

EXTERNAL LEAK- 
AGE - HIGH RATE 

•ROD DYNAMIC 
SEAL 

• STATIC SEAL TO 
AMBIENT 

SAME AS 1 
\ 

; SAME AS I 

i 

1 

1 

SAME AS i 

SAME AS 1 

! 

U1 1 

f : 

i 













SECTION 6 


PARAMETERS AND DATA 

6.1 TRADE-OFF PARAMETERS 

This section deals v/ith the parameters used in the trade-off evaluation and the origin of 
data used. Weight is displayed where possible in parametric form and serves as the cri- 
teria for establisliing the point design weights in Section? for the various configurations. 
All other parameters listed below are used to make qualitative comparisons. 

Weight 
Reliability 
Maintainability • 

Performance 
Checkout capability 
Cost 

6.2 WEIGHT 

6.2.1 HYDRAULIC TRANSMISSION . Figure 6-1 is a parametric curve of specific 
weight of transmission tubing versus flow. The two lines represent the end limits of 
0 ft length and 200 ft length. The 0 line represents a minimum for short runs. The 
200 ft line is based on 500 psi allowable pressure drop. This line was modified from 
Vickers data.^^ The Vickers data were based on 3000 -psi circuits where maximum 
efficiency (total vehicle minimum weight impact) occurred mth approximately 33% 
of maximum pump discharge lost in tubing pressure drop at maximum flow. For 
tins study, the ground rule circuit pressure is 4000 psi. The AP allowed in the 
tubing is 500 psi or 12% of maximum pump discharge pressvure. This is to conserve 
power because the pump discharge pressure drops to 2500 psi at maximum flow. 

Limiting the tubing drop would impose sizable weight penalties if perfornoance were 
required at low fluid temperatures. For the space shuttle, the operating oil temper- 
ature is assumed to be 70®F or warmer where tyiction (viscosity) losses are low. 

The tubing weights are based on using AM 350 high strength stainless steel and per- 
manent joint fittings. 
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TRANSMISSION LINE WEIGHT (WTRAN), 







6,2.2 HYDRAULIC PO\^^R GENERATION . A typical hydraulic power generation 
circuit schematic is presented in Figure 6-2 . The total weight of a circuit is broken 
down into the following elements: 

a. Tubing and fluid in tubing 

b. Pump (dry) 

c. Reservoir (dry) 

d. Miscellaneous components (dry) 

e. Fluid in components 

6,2.2. 1 Power Generation Tubing. The tubing within the power generation circuit 
cannot be estimated from Figure 6-1 because less pressure drop is allowed. Figure 
6-1 applies to transmission lines only, where up to 500 psi drop is allow'ed. The 
power generation tubing is based on an allowable pressure drop of 1 psi/ft. Figure 
6-3 shows this relationsMp. Comparing Figure 6-3 to Figure 6-1, one can see the 
specific weight of tubing is heavier. Another contributing factor to the increased 
specific weight is the addition of a pump case drain line. 



pressure 
{ ■ ■ \ RETURN 

t /; CASE DRAIN » 


Figure 6-2. Hydraulic Power Generation Circuit 
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Figure 6-3. Hydraulic Power Generation Tubing Weight 


6. 2. 2. 2 Pump Weights . The hydraulic pump weight was established as a function 
of rated flow. See Figure 6-4. Pump weights were obtained using Vickers data for 
inline pumps and adding a coxrrection factor for operation at 350 °F maximum and 
4000 psig. 

6. 2. 2. 3 Reservoir . The hydraulic reservoir weights are shown as a function of 
swept volume. See Figure 6-5. The reservoir is assumed to be a piston type. These 
data are based on previous designs used at Convair. Reservoir weight is more closely 
associated with total oil volume and differential displacement tlian with circuit flow. 

A reservoir size for any given circuit is approximately 15% of total circuit fluid volume 
plus differential volumes (accumulators only for flight control systems). The 15% in- 
cludes allowance for thermal contraction, fluid compressibility, thermal expansion, 
and leakage. 

6. 2. 2. 4 Miscellaneous Components . The remaining components in the hydraulic 
power generation circuit include such items as filters, valves, ground connections, 
accumulator, and instrumentation. The weight of these miscellaneous components 
is shown in Figure 6-6. This curve is based on a fixed weight of 10 lb and a variable 
weight that is a function of flow rate. 
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PUMP WEIGHT (WPUM), lb 



FLOW RAtE (QMAX), gpm ' . 


Pigxire 6-4. Hydraulic Pump Weight 
6-5 


































SWEPT VOLUME (DRES), gallons 


Figure 6~5. Reservoir Weight 



FLOW RATE (Q). gpm 


Figure 6-6. Miscellaneous Component Weight 
• , 6-6 


6,2.2. 5 Summary . The preceding data on power generation elements are shown to 
give background information that was used to develop the total hydraulic power gener- 
ation weight shown on Figure 6-7. The curve is not truly parametric. The change in 
slope of the curves between the booster and orbiter circuits is primarily due to the 
following fe-ctors: 

a. Longer transmission lines for the booster. (Transmission lengths assumed are 
shoTOi in Section 7.) Tins influences reservoir and reservoir fluid weights, 

b. Longer power generation lines for the booster. The lengths are assumed as 
follows: 

1. Orbiter: 25 ft each of pressure, return, and pump case drain. 

2. Booster: 40 ft each of pressure, return, and pump case drain. 

The booster line lengths are longer primarily due to larger power circuits and 
distance to ground connections. 

Also shown oh Figure 6-7 is weight for a rocket engine driven TVC hj^draulic circuit. 
This falls on the orbiter curve because of the sijmlarity of the assumed tubing lengths. 



FLOW RATE (Q), gpm/cirouit 


Figure 6-7. Hydraulic Power Generation Weight 
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6.2.3 HYDRAULIC CONDITIONmG . The hydraulic conditioiiing weight includes the 
heat exclianger (liydrogen-to-oll) and associated control valves. The heat exchanger 
size and heat load was deteriuined for four cases; 

a. Orbiter with four hydraulic circuits. 

b. Orbiter mth tliree hj'draulic circuits. 

c. Booster with fom’ hj^draulic circuits, 

d. Booster with three hydraulic circuits. 

Figure 6-8 displays hydraulic circuit flow rate and conditioning weight versus thermal, 
rate. The ratio of environmental heat rate to hydraulic generated heat rate (constant) 
varies from approximately 0. 66 for a 27 gpm circuit to 0.28 for a 265 gpm circuit. 

The thermal load was determined using the follo\iung assumptions : 

a. Maximum ambient temperature of the horizontal stabilizer is 600“ F, 

b. Only elevator equipment (lines and components) contribute to environmental load. 
CTIie mng hydraulics also contribute but are much smaller and are not included 

■ so that vehicle weight impact becomes a function of elevator systems only. ] 

c. Total length of tubing exposed to high ambient temperature: 

Orbiter: 50 ft (horizontal stabilizer runs) 

Booster: 75 ft (horizontal stabilizer runs) 

d. Emissitivity of lines and components in high temperature area = 0.6. 

e. Nominal temperature of hydraulic system is 300 ®F. 

f. Hydraulic equipment is insulated from hot structure (e.g. , conductive heat load 
is neglected). ■ 

g. Total heat load consists of; 

Environmental heat load 

Pump losses (Case drain flow 5% of rated flow) 

Leakage losses (5% of rated flow) 
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rcuit 


-CONDlTIONSj 

.1. THERMAL LOAD INCLUDES ' . 

EN VIRONME N TA L A ND SYSTEM . 
GENERATED HEAT. 

■ 2 . TEMPERATURES 

STABILIZER; 600®F (MAX) 
HYDRAULIC SYSTEM; 300*^F(NOM)- 
3. SYSTEM FLOW LOSSES ' ^ 

PUMP; 5% / 

SYSTEM. LEAKAGE; 5% ,Vr 





The heat exchanger size and weight ^yere based on: 

a. Cross/counter flow heat exchanger. 

b. Hydrogen gas is a\^ilable as a heat sink (200 and 100 psia). 

c. Mean AT in heat exchanger: outlet oil to inlet hydrogen = 360 '"R 

inlet oil to outlet hydrogen = 100'’F. 

d. The weight is a fixed weight of 10 lb plus an incremental weight wMoh is a function 
of equivalent tube weight to provide sufficient surface area, 

6,2.4 POWER SOURCE AND FUEL, Figure 6-9 shows APU weight versus shaft 
horsepower. The basic APU is shown as well as the total APU installation weight. 

The total weight is based on an installation weight of 50% of the APU weight plus a 
fixed weight of 15 lb for fire detection and fire extinguishing equipment. Figure 6-10 -• 
shows specific reactant (fuel) consumption (SRC) versus per cent rated capacity. The 
SRC varies slightly mth APU size but is not significant. Per cent rated capacity is 
significant, however. The average hp as established in Section 3 (38% for orbiter and 
30% for booster) converted to hp-hr and used udth Figure 6-9 determines the fuel weight 
reqvdred for each elevator configuration. See Section 7. 



Figure 6-9. APU Installation Weight 
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Figure 6-10. Part Load Specific Reactant Consumption 


6.2.5 HYDRAULIC ACTUATORS . Figure 6-11 shows actuator weight vei'sus work 
capability. This is essentially the base weight of the actuator including fluid but not 
valvlr^ or other integrated equipment. Work capability is used as the most convenient 
measurement for sizing actoators. The curve is independent of pressime and actuator 
geometry. It is assumed that geometric efficiency (ratio of moment arm length at 
maximuzn load point to bellcrank length) is approximately 90%. 

6.2.6 HYDRAULIC VALVES AND VALVE MANIFOLDS . Two curves are shown in 
Figures 6-12 and 6-13. The first curve lists electrohydraulic servovalve weights 
versus a flow function as shown. The upper portion (high flow rates) of the curve is 
not applicable because in high flow applications additional valve stages are added to 
keep the electrohydraulic servo relatively small. The second curve, Figure 6-13, 
identifies power valve and manifold weights. A 6. 5-lb fixed minimum weight is 
assumed. 
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Figure 6-12. Electrohydraulic Valve Weight 


POWER VALVE & MANIFOLD WEIGHT (WPV&M), lb 



Figure 6-13. Power Valve and Manifold Weight 









6.2.7 ELECTRICAL . Two basic elements are defined; motors and amplifiers. 
Amplifier weights are showm because of the gross differences in power levels required 
betiveen electrohydraulic and electromeclianical control. Additionally, some con- 
figurations employ more servoamplifLers tlian others. The delta weight differences 
are small when compared to overall weight but are displayed here so that a comparison 
can be made of servoactuator control portions. Figure 6-14 shov/s ac motor weights 
versus hp. The cui've is based on Westinghouse data. Figure 6-15 shows amplifier 
weight versus power output and is derived from information mthin Convair. 

6.2. 8 MECHANICAL. Spring clutch weight versus output torque is shown in Figva-e 
6-16. The curve is based on Curtiss-’W^ight data for bi-directional clutch assemblies 
without brake provisions. The curve is modified to incorporate braking. 

Differential weights, shown in Figure 6-17, are derived from data that established 

o 1 

weights of gear trains in a previous study conducted at Convair. 

Figure 6-18 is used to size the output ballscrew actuator used in the orbiter aileron 
configuration 2 and the secondary actuators used in the electromechanical control 
portions of orbiter aileron configuration 3, and orbiter and booster elevator con- 
figuration 3. Determining output ballscrew actuator weights is straightforward, tvith 
output force, stroke, and rate determined bj'' surface hinge moment requirements. 
Sizing secondary actuators is not straightforward in th^ the ballscrew is sized by 
hj^draulic power spool flow forces, friction, control loop maximum actuator rate and 
gain, power spool stroke, and secondary actuator/power spool geometry. The most 
predoininant factor is power spool, flow forces, especially in the very large servo - 
actuators where each of three power spools may be controlling up to 75 gpm. An 
equation used for correlation between the secondary actuator and hydraulic power 
spool size is: 

Fpv = 9. IQ +400 

where 

Fp.^ = power valve force 
Q = flow rate, gpm. 

The term 9. IQ is a function of flow forces and 400 is established as a minimum force 
capability. 

Ballscrew actuator weights in Figure 6-18 are shown in relation to force for different 
strokes. Unlike a hydraulic linear actuator, the ballscrew weights cannot be sho^vn 
in terms of work capability because within reasonable values of strokes and rotational 
speed, the ballscrew weight is more sensitive to force. 
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SERVOAMPLIFIER WEIGHT (WSA), 


200 


100 


" — I 1 1 — rn — — r 

1 CONDITIONS* ! 

» AinCIUFT AC MOTORS 

I CONTINUOUS DUTY 

FREQUENCY 400 H*. 200 volto 
* SPEED 7300 TO 7600 rpm 
WESTINGHOUSE DATA 


fr, 
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POWER OUTPUT (PWR) , horsepower . 



POWER OUTPUT (PWRSA) , watts • 

Figure 6-15. Servoamplifier Weight 
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CLUTCH ASSY WEIGHT (WCLl))', lb 










Figure 6-17. Differential Weight 



OPERATING LOAD (FBSA), lb 


Figure 6-18. Ball Screw Actuator Weight 
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6.3 RELIABILITY 


A computer program in existence at Convair was used to generate the reliability com- 
parisons show in Section 7. The analysis consisted of the following basic steps: 

a. Determine failure rate data from existing sources. 

b. Convert faiUure rates to failure s/tlight. 

c. Computer programming. 

d. Normalize results. 

6.3. 1 FAILURE RATE DATA. Two basic sources of failure rate data were used. 
They are RADC-TR-68-114 and FARADA. Low, high, and average failure rates 
were taken from these sources. The failure rates covered a wide range, but for this 
study the failure rates picked were, in general, conservative or representative of the 
high failure rates listed. 

6.3.2 FAILURES/FLIGHT. Table 6-1 lists the failure rate data used and the con- 
version to failures/flight. The column headings are identified as: 

\ = failure rate per 10 hours (from reliability data sources) 

expected failures x 10 /flight - boost pliase - booster (. 05 hr) 

-^6 

expected failures x 10 /flight - total flight time - booster (2. 5 hr) 

expected failures x 10 ^/flight - boost pliase - orbiter (2. 1 hr) 

-^6 

expected failures x 10 /flight - flight time - orbiter (2. 9 hr) 

The above mission times are not necessarily actual operating times for the various 
servoactuators but include total time that the units may be exposed to extreme en- 
vironments and/or be powered up. 

The failvure rate data shown for hj'draulic actuators, item 6, must obviously include 
all discrepancies that require maintenance action, but not necessarily serious failures. 
Two computer runs were made, one using the failure rate data as shown to establish 
maintainability comparisons. The failure rate of 765/10*^ hours was reduced to 76.5 
on the second run to establish reliability comparisons . Item 3 failure rates are show 
divided into two groups. The first number is "fail to open" failure mode and the sec- 
ond number represents "fail to close" failure mode. 

6.3.3 COMPUTER PROGRAMMING . The servoactuator is broken down in functional 
sets where all components in a set are in series. For example, consider a servo- 
actuator that employs three servo channels, three hydraulic circuits, a tandem power 
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Table 6-1. Failure Data 


Item 

Nomenclature 

1 

Hydraulic Pump 

2 

E/H 2 Stage Servovalve 

3 

Solenoid "Valve 

4 

Spool Valve 

5 

Spool Valve, Spring Loaded 

6 

Hydraulic Actuator 

7 

LVDT 

8 

Servo Amplifier 

9 

Power Amplifier 

10- 

Senm Motor 

11 

Differential 

12 

Ball Screw 

13 

Electronic Voter 

14 

Solenoid 

15 

Spring "Detent 

•16 

Spring Clutch 

17 

Gear Reduction 

18 

Tachometer 

19 

i Motor, A.C, 

20 

Pressure Switch 

21 

AP Transducer 

22 

Hydraulic Monitor 

1 

23 

1 

Hydraulic Comparator 

24 

Time Delay Relay 

25 

Valve Controller 

26 

Integrator 


\ 

’'tBl 

\b2 

Hoi 

^t02 

85 

4.2 

• 212 

179 

246 

125 

6.2 

311 

262 

362 

287/143 

14.4 

717/358 

603/301 

832/416 

62 

3.1 

155 

130 

180 

62 


‘ 155 

130. 

180 

•765 

38.2 

1912 

1607 

2220 

38 

1.9 

94 

79 

109 

160 

8 

400’ - 

• 336 

464 . 

320. 


800 


929 

107 


268 


310 

41 


103 

. 

119 

23 


58 


67 

263 


1 658 

1 

552 

763 

72 

. 



209 

20 


50 


58 

28 

• 



81 

46 




133 

126 


315 


365 

470 




1363 

368 

18 

920 

811 

1067 

368 


920 

811 

1067 

30 

1.5 

75 


87 

62 

3.1 


130 

180 

103 


258 


300 

4 


10 


12 

96 


239 


278 
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actuator, cross monitox'ing', detection., and correction. It is fail operate whereby it 
can lose one channel and/or one hydraulic circuit. The functional sets might be; 

s:et 

1 Servo Channel No. 1 

2 Servo Channel No. 2 

3 Servo Cliannel No. 3 

4 Hydraulic Supply No. 1 

5 Hydraulic Supply No. 2 

6 Hj’^draulic Supply No. 3 " 

7 Tandem Actuator (and Power Spool) 

8 By-Pass Function No. 1 

9 By-Pass Function No. 2 

10 By-Pass Function No. 3 

11 Monitoring and Detection 

A servo channel includes a servo amplifier, two-stage servo valve, LVDT feedback, 
and a secondary actuator. A reliability number for the servo channel is assigned 
using the failure rate data of all the components in the set and considering that ail 
the components are in series. This procedure is repeated for each functional set. 

For example, reliability of the bypass function is the reliability of a solenoid shutoff 
valve {to shut off) times the reliability of a pressure/spring -operated bypass valve 
{to by pass). 

A "minimum truth table" is then developed {based on the .failure modes and effects 
analysis) that describes all of the minimum ways in which the servoactuator can 
function and still be successful. The minimum truth table is prepared in binary form 
where a 1 means the set must function and a 0 means the set is not required to function. 

Shown below is an example of the table where the sets correspond to those shown above 
and the rows represent the combinations {minimum number of ones) that can exist for 
success. 


SET 

1 2 3 4 5 6 7 ‘ 8 ' 9 10 11 

1101101. 0 01 1 
1 0 1 1 o'l 10 1 0 1 

0110111100 1 

The reliabilities for the sets and the minimum truth tables were then submitted to 
the DCS and 7094/7044 computer to calculate the system reliability. The computer 
determines aH the combinations that can be successful and computes the probability 
of any successful combination that might exist. For example, the computer calculates 
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the probability of all sets functioning correctly, then proceeds downward to a minimum 
limit established by the minimum truth table. The summation of the probabilities of 
all the successful combinations that can exist is the reliability of the unit. 

6.3.4 NORMALIZE RESULTS . Since absolute reliability numbers are only as good 
as the original failure ra.te data used, an additional step was taken. The reliability 
numbers are normalized based on the least reliable configuration (in a group being 
compared) reduced to 1. Therefore ail comparisons are in whole numbers and the 
larger the number the better the ranldng. 

6.4 QUALITATIVE COMPARISONS 

Maintainability, checkout capability, performance, and cost are treated qualitatively. 
Major features or characteristics are shown in tables in Section 7. The following 
paragraphs list criteria that was used for comparison. 

6.4.1 MAINTAINABILITY . Criteria for comparison. 

a. Mean flights between maintenance action (MFBMA) . 

The probability (Pg) that all fimctions work successfully within a servoactuator 
was determined from the first computer run using the high failure rate data for 
actuators. 1 - Pg is then the probability of failure (maintenance action). The 
reciprocal 1/1 - Pg = MFBMA . The MFBMA data is normalized in the same 
manner as described in Section 6.3.4. 

b. Number of components. 

For aerodynamic surface control actuators only servoactuator components are 
totaled. Electronic logic where used was assumed to be equivalent to many com- 
ponents (up to 20) and the actual number was estimated based on apparent com- 
plexity. TV (5 servoactuator component count includes hydraulic power circuit 
components where rocket engine driven circuits are used. Twelve components 
per circuit were assumed. 

c. Installation complexity. 

6.4.2 CHECKOUT CAPABILITY . Comments in Section 7' are based on capability 
of performing three checkouts listed below in order of importance, 

a. Normal operation. 

b. Health status of each servo channel. 

o. Health status of fault detection and switching. 

6.4.3 COST . Relative comments in Section 7 are based on the three factors listed 
below: 

a. Unit procurement cost. 

b. Operational cost. 

c. Development cost. 


6-21 



SECTION 7 


TRADEOFF EVALUATION 

7. 1 GENERAL 

This section contains the tabulation of all results and comments and is arranged as 
follows: 

7. -2 BOOSTER AND ORBITER ELEVATOR 

7. 2. 1 BOOSTER WEIGHT 

7.2.2 ORBITER WEIGHT 

7.2.3 ALTERNATE ORBITER ELEVATOR ARRANGEMENT 
7.3- ORBITER AILERON 

7.4 DIGITAL SERVO ACTUATOR COMPARISON 

7.5 ORBITER TVC 

7.6 BOOSTER TVC* 
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7. 2 BOOSTER AKD ORBITER ELEVATOR 


7, 2. 1 BOOSTER WEIGHT 


Basic data used to generate weight: 



3 Hydraulic 

4 Hydraulic 


Power Circuits 

Power Circuits 

Hinge Moment Total Req'd, Ft~lb 

650,000 

650,000 

Hinge Moment/Power Circuit, ft-lb 

650,000 

325,000 

Hinge Moment/Actuator /Side , ft-lb 

325,000 

162,500 

Flow to Elevator Syslem/Circuit, gpm 

265 

133 

Flow to Each Actuator/Side, gpm 

133 

67 

Length - APU to Aft Vehicle ft 

25 

25 

Length ~ Actuators to Vehicle ft 

75 

75 

Max APU HP/Hydraulic Circuit, hp 

430 

215 

Ave Hp/Circuit - % of Max, & 

30 

30 

Flight Hours - Operating Time, hr 

1,72 

1.72 

Hp-Hr 

222 

111 


Table Weight - Elevator, Booster 


Nomenclature 

Configuration 3 

Configuration 2 

Configuration 3 

No. 

Unit Wt. 
Xi) 

Total Wt. 
Lb 

No. 

Unit Wt. 
Lb 

Total Wt. 
Lb 

No. 

Unit WL 
Lb 

Total Wt. 
Lb 

Sen'oactuator: 

8 






■ 



Actuator 


315 



630 

2320 

H 

585 

3510 

Pwr Valve & Manifolds 


13 



52 



120 


Control Portion 


4.4 



18 



52 




332.4 

2659 

2 

70 

140 

2 

172 

344 

Synch. Shaft 

2 

10 

20 



* 

- 



Hyd. Power Generation 

4 

716 

2864 

4 

716 

2864 

3 

1222 

3666 

Hyd, Transmission 

4 

285 

1140 

4 

285 

1140 

3 

455 

1365 

Hyd, Conditioning 

4 

18 

72 

4 

18 

72 

3 

30.5 

92 

APU 

4 

182 

728 

4 

182 

728 

3 

325 

975 

APU Fuel 

4 

416 , 

1664 

4 

416 

1664 

3 

832 

2496 

Total Vehicle Weight 



9147 



9128 



12448 

AWeight 



0 






-^3300 
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7.2.2 ORBITEK WEIGHT 


Basic data used to generate weight: 


Hinge Moment Total Req'd, ft-lb 
Hinge Moment/Power Circuit, ft-lb 
Hinge Moment/Actuator/Side, ft-lb 
Flow to Elevator System/Circuit, gpm 
Flow to Each Actuator /Side, gpm 
Length - APU to Aft Vehicle ft 
Length - Actuators to Vehicle ^ , ft 
Max APU Hp/Hydraulic Circuit, hp 
Ave Hp/Circuit - % of Max, % 
Flight^Hours - Operating Time, hr 
Hp-Hr 


.3 Hydraulic 

4 Hydraulic 

Power Circuits 

Power Circuits 

133,000 

133,000 

133,000 

66,500 

66,500 

33,250 

54 

27 

27 

13.5 

15 

15 

50 

50 

88 

44 

38 

38 

0.83 

0.83 

28 

14 


Table 7-2. Weight - Elevator, Orbiler 


Nomenclature 

Configuration 1 j 


Configuration 2 

Configuration 3 | 

No. 

Unit we. 
lb 

Total Wt. 
U> 

No.* 

UnitWt. 

Lb 

Total Wt. 
Lh 

No.. 

Unit Wt. 
Ii3 

Total Wt. 
Lb 

Servoactuator 

8 

* 








Actuator 


76 


4 

152 

608 

b 

142 

852 

Pwr Valve & Manifolds . 


6.8 



27 



21 


Control Portion 


3.2 



14 



48 




86 

688 

2 

41 

- 82 

2 

69 

138 

Synch, Siaft 

2 

6 

12 







Hyd, Power Generation 

4 

191 

764 

4 

191 

764 

3 

285 

855 

Hyd. Transmission 

4 

61 

244 

4 

61 

*244 

3 

99 

297 

Hyd. Conditioning 

4 

12 

48 

4 

12 

48 

3 

13 

39 

APU 

4 

62 ' 

248 

4 

62 

248 

3 

95 

285 

APU Fuel 

4 

48 

192 

1 

4 I 

48 

192 

3 

96* 

288 

Total Vehicle Weight 



2196 



2186 



2764 

A Weight 



0 






+ 540 
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Table 7-3. Heliability Comparison — Elevator, Orbitcr and Booster 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

prcbabiXity of Mission 
Sjccass 

. 99995 

. 99927 

.99918 

Kelalive IXanking 

16.4 

1.12 

1 

Table 7-4 

Maintainabiiity Comparison — Elevator, Orbiter and Booster 

Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

MFBMA {Mean Flights 
Between Maintenance 
Action) 


* 

• 

a. Probability of All 
Elements Working 

.9639 

" .9748 

. 9929 

b. . MFBMA 

28 

39.7 

141 

c. Helative Banking 

1 

1.4 

5 

Com ponents/Vehicle 

134 

• 120 . 

132 

Installation 

8 Separate Valve Packages, 
Integral ’witii Actuators. 
Difficult to Troubleshoot 
Installation. 

2 Unitized Valve Packages, 
Remote From Actuators. 

® 2 Unitized Valve 

- Packages, Remote 
From Actuator. 

® Large and Heavy 
Units 


Table 7-5. Performance Comparison - Elevator, Orbiter and Booster 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Normal Performance 

Lower Static Stiffness 
and Positional Accuracy 
Due to Power Spool 
Synch. Method 

o More Adaptable To 
Spreading Actuators 
Along Hear Spar 

o Stiffness Better Tlian 1 
If Dual Tandem Spools 
Can Be Synchronized By 
Fabrication. 

o Stiffness Better Than 1 . 
If Triple Tandem Spools 
Can Be Synchronized By 
Fabrication. 

0 May Be Subject To Small 
Amplitude Limit Cycling 
If Tach Feedback Gam 
Can^t Hold Channels At 
Null. 

Redundancy Performance 

• Nuisance Tripping May 
Be Problem. 

e Negligible Degradation 
After Channel Failure. 

© Less Nuisance Tripping 
Than 1 Due to Cross 
Equalization . 

o Negligible Degradation 
After Channel Failure. 

0 Same as 1. 

Versatility And/Or 
Coaim onality 

F ault Correction Can Be 
Manual Function of Crew 
Due to Force Summing 
Mechanization. 

Same as 1. 

0 Requires Automatic Fault 
Correction. 

c Can Be Used With 2, 3 
Or 4 Hydraulic Power 
Systems With No Change. 
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Table 7-6. Checkout Capability — Elevator, Booster and Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Normal Operation 

Add Surface Position 
XDCR Or Surface 
End Position Limit 
Switches To Provide 
Output Signal To The 
Chec kout/Monito ring 
Function. 

Use Actuator Position 
XDCR Signal. 

Same as 2. 

Single Channel Operation 

e Add Switching To Dis- 
able Self Equalization 
And Fault Detection. 

o Add Switching To Disable 
Cross Eqidization & 

Fault Detection Logic. 

e Add Switching To Disable 
Fault Delection Logic. 


8 Add Switching to De- 
energize Solenoid Shutoff 
Valves. Operate One On 
At A Time. 

0 Add Switching to De- 
energize Solenoid Sliutoff 
Valves. Operate One On 
At A Time. 

0 Add Switching to Shut Off 
Elect Power To Each 
Channel. 

Fault Detection 

o Add Program , 

to Introduce 
Hardover Failures 

«> De-Dnergize Shutoff Valves 
in Sequence and Observe 
Failure Indication * 

Q Switch Off Elect Power To 
Servos In Sequence And 
Observe Failure Indica- 
tion, 


©Add Reset Provisions. 

« Add Reset Provisions 

e Add Reset Provisions. 


Table 7-7. 


Cost Comparison — Elevatofi Booster and Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Unit & Instl, Costs 

, High — Due To 4 Power 
Circuits And 4 Power 
Actuators. 

High — Same As 1. 

Lower Than Configura- 
tion 1 Or 2 Due To 3 
Power Circuits And 3 
Power Actuators. 

Operational Cost 

High - Complexity And ' 
Low MFBMA Means High 
Maintenance, 

High — Same As 1 

Less Than Baseline, 
Fewer Power Circuits, 
Higher MFBMA. 

Development 

Low — Similar Unit Of 
Same Size Range Under 
Development. 

Medium - Similar Unit 
Of Small Size Under 
Development. Problem 
With Power Spools* 
Synchronization. 

Medium — Control 
Portion Under Develop- 
ment. Problem With 
Power Spools* Syn- 
chronization. 
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7,2.3 ALTERNATE ORBITER ELEVATOR AERANGEMENT, The pi'evious three 
conligurations for the orbiter elevator required one servoactuator package in each 
left and right horizontal stabilizer. There are many alternate physical installation 
options to consider' , but one that deserves attention is a center fuselage installatioa 
using four power actuators. The servoactuator has many advantages; 

a. Less severe environment (vibration and temperature). 

b. Only four valve /actuators instead of eight. 

c. More installation space. 

d. Less weight in the actuators and elimination of horizontal stabilizer, 
transmission lines. 

e. Better maintenance. 

A key structural consideration in determining the required actuator configuration is 
flutter. For the center -fuselage-mounted arrangement the moment will be reacted 
in the body, whereas for the actuators mounted in the horizontal stabilizer, the 
moments will be reacted there. In the case of die fuselage-mounted actuators , the 
elevator torsional stiffness must be sufficient to prevent excess aeroelastic losses 
due to elevator tmst. In the case of actuators mounted, in the stabilizer , the elevator 
torsional stiffness is not as critical since it is effectively clamped in torsion at the 
actuator points. The horizontal stabilizer twist due to the elevator hinge moment in 
this case should be small because the horizontal stabilizer structure is sized for 
max aq. 

By actuating the surface at the root only, a large structural weight increase may be 
required in the elevator to provide enough stif&iess to prevent flutter. It is not the 
intent of this discussion to determine what that weight increase is , but to point out 
that mth a center -fuselage-mo mited servoactuator grouping, a weight savings of 
approximately 250 lb can be realized v/ithin the servoactuator and power supply sub- 
systems. 
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7.3 ORBITER AILERON 


Basic data used to generate weight: 


3 Power Systems 
Active/Standby 
Hj^draulic 

or Load 

Elect/Mech Sharing 


Hinge Moment Req'd, ft-lb 

9,600 

9,600 

Hinge Moment Req'd/Power Circuit, ft-lb 

9,600 

6,400 

Hinge Moment/Actuator/Side, ft-lb 

4,800 

3,200 

Flow to Aileron System/Hyd Circuit, gpm 

5.2 

3.5 

Flow to Each Actuator /Side, gpm 

2.6 

1.75 

Length - APU to Mid Vehicle ft 

50 

50 

Length - Actuators to Vehicle ft 

100 

100 

Aileron Max. No Load Rate, deg/sec 

40 

40 


Table 7-8, Weight — Aileron, Orbiter 



Configuration 1 

Configuration. 2 

Configuratj 

on 3 

Nomenclature 

No, 

Unit Wt. 
Lb 

fotal Wt, 
Lb 

No. 

Unit V/t, 
Lb 

Total Wt. 
Lb 

No. 

Unit Wt. 
Lb 

Total Wt, 

Servoactuator: 








mmm 


Power Actuator 

6 

10 

60 

2 

50 

100 

6 

^9 

■ 43 

Control Portion 


22,5 


2 

7.0 

14 


45.0 


Pwr Valve &/or 
Manifolds 


13,5 






19.5 



2 

36 

72 




2 

64.5 

129 

Differential 




2 

11 

22 




Solenoids & Spring 
Clutch 




6 

7.7 

46 







132 



182 



172 

Hyd. Transmission 

3 

53 

159 




3 

42.5 

128 

Elect, Motor and Gearing 





6 


217 




Total Weight 



2.91 



399 



300 

A Weight 


• 

0 



+108 



+9 











Table 7 '9. Reliability Companson — Aileron, OrbjEer 


Ci'iteria 

Configuration 1 

Configuration 2 

Configuration 3 

Probability Of Mission 




Success 

. 099998 

. 999027 

. 99918 

Relative Ranking 

,486 

1 

1. 19 


Table 7-10^ Maintainab)lity Comparison — Aileron, Orb iter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

MFBMA (Mean Flights 
Between Maintenance 
Action) 




a. Probability Of All 
Elements Working 

.9736 

.9866 

.9929 

b. ' MFBJfA 

37.9 

74.6 

141 

c. Relative Ranking 

1 

2 

3.7 

Com ponents/Ve hide 

' 98 

128 

132 

Installation 

Smallest Envelope. 

Most Feasible To Install 
And Remove. 

Integrated Power Supply 
Makes Unit Lai'ge And 
Heavy. ^ 

Similar to 1 But Larger 
' Envelope And Heavier. 


Table 7-11. Performance Comparison — Aileron, Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Normal Performance 

Good. No Fight Between 
Outputs, Only 1 Active At 
A Time. 

Poor. Subject To Limit 
Cycling, High Threshold 
And Dead Zone. 

May Be Subject To Small 
Amplitude Limit Cycbng 
If Tach Feedback Gain 
Can*t Hold Channels At 
Null, 

Redundancy Performance 

© May Be Subject To 
Nuisance T lipping. 

© Output Rate Is Degraded 
After Failure. 

Same As 1, 

. 

® No Degradation After 
Failure. 

o Dependent On No Jamming 
At Output. 

. 

Versatility And/Or 
Commoiiaiity 

o Fault Correction Hyd. 
Logic Must Remain With- 
in Servoactuator Inter- 
face. 

© Requires Automatic 
Fault Correction. 

© Requires Automatic 
Fault Correction. 

o Requires Automatic 
Fault Correction. 

o Can Be Used With 2, 3 
Or 4 Hydraulic Power 
Systems With No Change. 
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Tabic 7-12. Checkout Capability * Aileron, Orbiter. 


Cntoria 


Configuration 2 

Configui-ation 3 

Normal Operation 

Use Actuator Position 
XDCR To Provide Output 
Signal To Checkout/ 
Monitoring Function, 

Use Actuator Position 
XDCR Signal. 

Use Actuator Position 
XDCR Signal. 

Single Channel Operation 

Must Stait Up And Shut 
Down Hydraulic Systems 
In Sequence Or Add 
Hydraulic Suitoff Valves 
And Control Switches. 

Add S^vitching To Shut 
Off Electrical l^ower 
In Sequence. 

© Add S-^vitching To Disable 
Fault Detection Logic, 

a Add Switching To Shut 
Off Electrical Po^^'er To 
Each Channel. 

♦Fault Detection 

^Shutting Off Hydraulic 
Power Will Not Check 
Status Of Monitors And 

o *Add Program To 
Introduce Hardover 
Signals Sequentially To 
Servoamplifiers Down- 
stream of Voters. 

0 Must De-pressure And 
Rcpressurize Hydraulic 
Circuits For Reset Or 

1 Add Shutoff Valves. 

' 

o Introduce Command 
Input With Electrical 
Power Off To All 
Clutches An Observe 
Power Stage Failure 
Indication. 

e Swtoh Off Electrical 
Power To Servos In 
Sequence And Observe 
Failure Indication. 

© Add Reset Provisions, 

Comparator. 

$ Add Piogram To Intro- 
duce Hardover Signals 
(Electrical Power Off 
To Power Stages) 
Sequentially And Ob- 
sen^e Command Failure 
Indication. 

• 



6 Add Reset Provisions. ^ 



Table 7-13. Cost Comparison — Aileron, Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Unit fis InstL Costs 

Low, Smaller Envelope, 
Fewer Parts. 

Medium. Difficult Instl. 
Fabrication, 

Low, 

Operational Cost 

High Due To High Main- 
tenance Required (Low 
MFBMA), 

Less Than Configuration 1, 
(Less Maintenance 
Required) . 

Low, (High MFBMA), 

Development Cost 

Low, Similar Units 
Under Development. 

High. Requires Extensive 
Development, 

Medium, Control Portion 
Under Development, 
Problem With Power 
Spools* Synch romzation. 
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7,4 DIGITAL SERVO ACTUATOR COMPARISON 


A digital configuration weight was established for the orbiter aileron, orb iter elevator, 
and booster elevator. They are compared to the analog configurations as shown in 
Figure 7-1, The weight is approximately equal to Configuration 1, ailei’on orbiter, 
but tends to become heavier than analog electohydrauhc when compared at the elevator 
applications (+70 lb for the orbiter, +260 lb for the booster). In the case of the aileron, 
the digital configuration has less weight in the actuators , but more weight in transmis- 
sion lines. This is due to the four power circuits it has compared to three. (The 
digital configTiration uses four power circuits, analog Configuration 1 uses three.) The 
flow rates are small allowing small digitizers to be used; thus they have little influence 
on weight but become sensitive to fabrication tolerances . 

For the larger aj)plications , the increased weight trend of the digital configuration 
over that of analog Configurations 1 and 2 is due primarily to the digital valving (all 
use four power circuits). The valving becomes unwieldy at high flows and the assump- 
tion of a 30 -Hz cycling rate may not be valid for the large digitizer spools. 

The reliability of the digital configuration compares favorably with the analog configiura- 
tions even though the upper stage servo failure rates were assumed to be 10 times that 
of an equivalent analog. This assumption was made to compensate for the increased 
number of cycles imposed on a torque motor for digital applications . 

The reliability of the digital configuration remains Mgh, apparently, due to the multiple 
redundancj’^ and failure effects, which are less severe in digital systems. 

The maintainability suffers drastically in the digital configuration. The duplication of 
servos and digitizers in each channel coupled with high failure rates result in an esti- 
mated MFBMA of 7. 5. This compares with analog configurations that range from 28 
to 140. 

The critical comparisons between the digital and analog configurations are in the area 
of performance and deyelopment. Performance of the analog type has been verified by 
development, testing, and usage. As stated befoi'e , die digital configuration in this 
report is a concept only and does not represent any previous development effort with 
regard to redundancy mechanization. Witliout detailed investigation, there remains 
considerable doubt that pulse synchronization and exact positioning between channels 
can be achieved. 

In summary, the comparisons show that a digital configuration can be competitive in 
most areas with analog types , but more investigation and development effort is needed. 



SYSTEM WEIGHT, Ib/vehicle element 




7. 5 ORBITER TVC 


NOTE: Configuration 1 for the orbiter is the same as Configuration 1 for the 

booster. These configurations operate off the vehicle APU driven 
hydraulic circuits. 


Basic data to generate weight: 

Max Hinge Moment/Axis/TVC, ft-lb 

Hinge Mornent at Max Rate/Axis/TVC, ft-lb 

Max Flow Rate/Axis/TVC, gpm 

Max Flow Rate/TVC (1.41 x Max Flow/Axis), gpm 

Flow Rate/Circuit/Engine Mounted Hyd. Supply, gpm 

Flow Rate/Circuit/APU Driven Hyd. Supply, gpm 

Length *• ASC Junction to Engine Bulldiead, ft 

Length - Bulldiead to Actuator s/TVC/Gircuit, ft 

Leiiglh - Engine Mounted Hydraulic Transmission/TVC/Circuit, -ft 


65.000 

44.000 
8.8 
12.3. 
12.3 
12.3 
21 

17 

16 


Table 7-14. Weight Comparison — TVC, Orbiter 



Configuration 1 

Configuration 2 

Configuration 3 

Nomenclature 

No. 

Unit Wt. 
Lb 


No. 



No. 

UnTTV/t. 

Lb 

'lolal Wl. 
Lb 

Servoactuator 

4 



4 



4 . 



Power Actuator 


58 



60 



58 


Control Portion 


18.5 


* 

15 



14 


Pwr Valve And/Or 
Manifold 


9 



13 



16 . 



85.5 

342 


88 

352 


' 88 

352 

Centering 










Actuator 

4 

20 

80 


' 


4 

20 

80 

Accumulator 

2 

20 

40 







Valve 

2 

2 

4 

2 

2 

4 

2 

2 

4 

Hyd* Po^ser Generation 




6 

125 

750 

4 

124 

496 








2 

83 

166 

H 3 <d. Transmission 

4 

30 ‘ 

120 

6 

13 

78 

6 

13 

78 

Total Weight 



586 



1184 



1176 

AWeight 



0 j 



+598 ' 



+590 
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Table 7-15, Kel lability Comparison — TVC, 'Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Probability of Mission 
Success 

* 99998 

.99941 

* .99904 

Relative Ranking 

48*5 

1. 65 

1 


Table 7-16. Maintainability Comparison — TYG, Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

MFBRL4 




Probability Of All Elements 
Working 

.9915 

.9862 

,9876 

MFBMA 

118 

73 

81 

Relative Ranking 

1.G2 

1 

1.11 

Components/Vehicle ' 

128 

252 

212 

Installation 

Difficult Actuators^ InstI, , 
But Requires No Engine 
Mounted Hydraulic Circuits, 

Poor. Due to Separate 
Engine Mounted Hydraulic 
Circuits. 

Poor. Difficult Actuators* 
Instl. Plus Engine Mounted 
Hyd, Circuits.' 


Table 7^17. Performance Comparison — TVC, Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Normal Performance 

a Good. No Fight Between 
Outputs, Only 1 Active At 
A Time. 

Good 

May Be Subject To Small 
Amplitude Limit Cycling. 

Redundancy Performance 

c No Degradation After 
Failure. 

a Nuisance Tripping May 
Be Problem 

o Slight Degradation After 
Failure. * 

o Output Actuator Rate 
Reduced 50% After 
Failure. 

o Nuisance Tripping May 
Be Problem. 

Versatility And/Or 
Commonality 

Common To Booster 
Configuration. 
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Table 7-18, Checkout Capability — TVC, Orbiter 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Normal Operation 

Use Actuator Position 
XDCR To Provide Output 
Signal To Checkout/ 
Monitoring Function. 

Add Actuator Position 
XDCR Or End Position 
Limit Switches. 

Same as 1, 

Single Chaimei Operation 

Must Start Up And Shut 
Dovai Hydraulic Circuits 
In Sequence Or Add 
Hydamlic Sliut Off Valves 
And Control Switching. 

0 Add Switching To Dis- 
able Cross Equaliza- 
tion & Fault Detection 
Logic. 

0 Add Switching To De- 
energize SImt Off Valves. 

o Add Switching To Dis- 
able Fault Correction 
Logic. 

c» Add Switching To De- 
.energize Shut Off 
Valves. 

Fault Detection 

1 

o Add Program To Intro- 
duce Hardover Signals 
Sequentially To Servo 
Amplifiers, 

1 

o Do-energiza Shut Off 
Valves In Sequence 
And Observe Failure 
Indication. 

o Add Reset Provisions. 

o Same as 2. 


Table 7-19, Cost Comparison — TVC» Ox-biter 


Criteria 

— 
Configuration 1 

Configuration 2 

Configuration 3 

Unit & Instl. Costs 

Low. Fewer Parts. 

High. Due To Multiple 

High. Same As 2, 



Engine Mounted Hydraulic 




Circuits, 


Operational Costs 

Low. Same As Above. 

High. Same As Above. 

i High. Same As Above. 

Development Cost 

Low, 

Low. 

1 

, liOW. 
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7.G BOOSTER TVC 


NOTE: Configuratioa 1 for the booster is the same as Configuration 1 for the 

orbiter. These conRgurations operate off veliicle APU driven li 3 ’’drau- 
lic circuits. 

Basic data to generate weight: 


Max Hinge Moment/Axis/TVC, ft-lb , 65,000 

Hinge Moment at Max Rate/Axis/TVC, ft-lb 44,000 

Max Plow Rate/Axis/TVC, gpm 8. 8 

Max Flow Rate /TVC (1.414 x Max Flow/Axis), gpm 12.3 

Flow Rate/Circuit/Engine Moimted Hyd. Supply, gpm 12.3 

Flow Rate/Circult/APU Driven Hyd. Supply, gpm 74 

Length - ASC Junction to Engine Bulkhead, ft 35 

Ave Length - Bulkhead to Actuators/TVC.(AP.IJHyd.), ft 30 

Length - APU Hj'd. Transmission (6 Engines/Circuit, ft 180 

Length - Engine Mtd. Hyd. Transmission/TVC/Circuit, ft 16 


Table 7-20. Weight Comparison - TVC, Booster 



, Configuration 1 

Configuration 2 

Configuration 3 

Nomenclature 

No. 


Total Wt. 
Lb 

No. 

Unit Wt. 
Lb 

HESli 



Hi 

Servoactuator 

22 



22 



22 



Power Actuator 


58 



51 



51 


Control Portion 


18.5 




• 


7.5 


Pwr Valve And/Or 
Manifolds 


9 






13 




85.5 

1881 


62.5 

1375 


71.5 

1573 . 

Centering 










Actuator * 

22 

20 

440 







Accumulator 

11 

20 

220 

11 

20 

220 




Valve 

11 

2 

22 

11 

2 

22 

11 

2 

22 

Hyd. Power Generation 




11 i 

125 

1375 

11 

125 

1375 








11 

S3 

915 

Hyd. Transmission 

4 

258 

,1032 1 

11 

13 

143 

22 

13 

286 

Total Weight 



3595 



3135 

• 


4171 
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Table 7-21. Reliability Comparison — TVC, Booster 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Probability of 


* 

• 

Mission Success 

. 999996 

. 999996 

.99980G 

Relative Ranking 

2,5 

! 2.5 

1 


/ 


Table 7-22. Maintainability Comparison — TVC, Booster 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

MFBMA 




Probability Of All Elements 
Woi’king 

.39984 

. 99D91 

.99983 

MFBIIA 

6250 

11. Ill 

5888 

Relative Ranking 

1,06 

1,89 

1 

Components/Vehicle 

766 

444 ■ 

720 

Installation 

Difficult Actuators 
InstI, , But Requires Ko 
Engine Mounted Eydraubc 
Circuits. 

Fewer Actuators To 
Maintain, But Requires 
11 Engine Mounted 
Hydraulic Circuits. 

Poor. Tandem Actuator 
Insll. Plus 22 Engine 
Mounted Hydraulic 
Circuits. 


Table 7-23. Performance Comparison — TVC, Booster 


Criteria 

Configuration 1 

Configuration 2 

Configuration 3 

Kormal Performance 

Good. 

Good. 

Good, 

Redundancy Performance 

0 No Degradation After 
Failure (Fail Operate 
Capability) , 

0 Nuisance Tripping May 
Be Problem,, 

0 Fail Operate In Upper 
Servo Stage, Some 
Degradation After 
Failure. 

o Not Fail Safe After 2 
Like Failures. 

0 Fail To Null Capability 
Only. 

Versatility And/Or 
Commonality 

« Common To Orbiter 
Configuration, 

e No Monitoring - Health 
Status Cannot Be 
Verified In Flight. 
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Tabic 7-2<fc, Checkout Capability — TVC, Booster 


Criteria 

Configuration 1 

Comiguration 2 

Configuration 3 

Normal Operation 

Use Actuator Position 
XDCR To Provide Output 
Signal To Checkout/ 
Monitoring Function. 

Add Actuator Position 
XDCR Or End Position 
Limit Switches. 

Same As 2, 

Single Channel Operation 

Must Start Up And Shut 
Down Hydraulic Circuits 
In Seciuence Or Add 
Hydraubc Sliutoff Valves 
And Control Switching. 

Add Program To 
Introduce Opposite Hard- 
over Signals To 2 Servo 
Channels Sequentially 
To Disable All But One, 

Same As Normal 
Operation. 

Fault Detection 

Add Program To Litroduce 
Hardover Signals Sequen- 
tially To Servo Amplifiers, 

Not Applicable. 
Servoactuator Is 
Monitorless (No Detec- 
I tion, Correction) 

Add Program To Intro- 
duce Hardover Signal To 
Either Servoamplifier. ' 


Table 7-25, Cost Comparison — TVC, Booster 


Criteria 

Configuration 1 

Configuration 2 


Unit & InstL Costs 

High. To Be Common To 
Orbiter And Also Use APU 
Power, Excess Redundancy 
Is Applied At All 22 
Actuator Instls. 

Ix)wer Than 1. Simpler 
Actuator Partially Offset 
By The 11 Engine Mounted 
Hydraulic Circuits, 

High. Excess No, Of 
Engine Mounted Hydraulic 
Cir6uit Instls. 

Operational Costs 

High, Due To Number Of 
Components To Stock & 

\ Maintain. 

Lrow. Fewer Parts. 

Same As 1. 

Development Costs 

Low. 

Minimum. Similar Unit 
Fully Developed. 

Low. 
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SECTION 8 


DISCUSSIONS AND RECOMMENDATIONS 


8.1 DISCUSSION 

8.1.1 WEIGHT TRENDS 

8; 1. 1. 1 Intermediate Applications. Figure 8~1 is a plot of servoactuator and trans- 
mission line weights for three and four power circuits through alt hinge moments of 
interest for aerodynamic surface controls. This ti'end is only valid if tlie ground 
rules and requirements of this study apply. That is, there is no alternate function 
to back up an aerod 3 mamic control surface, and fail operate, fail safe (e.g. , fail 
operate) performance is required. The fail operate , fail operate rule allows each- of 
the four actuators to be designed for 50% of the required hinge moment after two fail- 
ures. This concept weighs less than a three-actuator arrangement dovm to the lower 
limit where valve and hydraulic transmission weights begin to have influence. No 
other power weights are included. 

8. 1. 1. 2 Electromechanical . The only pure electromechanical configuration studied 
was applied to the orbiter aileron. The weight did not compare favorably with hydrau- 
lic configurations primarily due to the electric motor weight. The motor sizes were 
determined by torque requirements resulting in oversized motors with respect to 
horsepower rating. Due to the limited time available for detail design analysis, no 
attempt was made to apply the balanced power concept.^^ This concept involves the 
use of flywheel inertia to absorb power peaks allowing the motors to be sized for 
average power demand, thus reducing overall weight. The electromechanical unit ‘ 
was configured as an integi'ated package (power and control). Tliis configuration 
would be very difficult to install in the limited space in t!ie wing and more likely would 
consist of control channels, clutches, and motors in the fuselage with mechanical 
shafting installed in the wing to an output ballscrew or power hinge. No weight penalty 
was assigned for mechanical shafting to offset the over-design of the motors. 

8. 1. 1. 3 Electromechanical Control. The electromechanical velocity summing con- 
trol unit was used with three hydraulic circuits (Configuration 3 , aerodynamic surface 
controls). This conliguration is obviously heavy because of the use of three hydraulic 
power circuits. Figure 8-2 shows the comparison of just the electromechanical and 
electrohydraulic control components. The electromechanical weights for this study 
are showm by the upper solid line. The criteria used for sizing channel control outputs 
were conservative and affected electromechanical weights more than electrohydraulic. 
The dotted line represents a reduced size for electromechanical control where the 
output force ranges from 40j0 lb at small flows to 1000 lb at high flows. The reduced 


8-1 



ACTUATOR AND TMNSMISSION WEIGHT, Ib/surface 



Figure 8-1. Scrvoactuator and Transmission Weight 




SERVO CONTROL WEIGHT 



400 


Q gpra 


Figure 8-2. Weight - Electromechanical vs. Electrohydraulic Control 









electro medianical control is still heavier than its electrohj'draulic counterpart but 
the A weight is less significant in comparison to power actuator and power circuit 
weights . 

8.1. 1.4 Eedundancy vs. Weight - Aerodynamic Surface Controls. The configurations 
in this study define the limits of redundancy required to ineet fail .operate , fail operate 
criteria. The redundaiicy v^as carried through to the power stages. The result is a 
rather dismal weight total. It is no surprise to note that most of the weight is packed 
into the power systems and power actuators. 

We assume that a hydraulic power actuator never jams. If redundant seals are used 
to reduce lealcage failures and adequate margins are biiilt in to preclude any structural 
failures (barrel rupture) the actuator becomes very reliable and as such may not need 
to be as redm^dant as other elements. Figure 8-3 shows the effects on weight when 
power actuator and power circuit redundancy are reduced. The curves are based on 
averaged data: 1. 5 hr flight time, 35% average power and 40 ’ft transmission length. 
Curve A is the four-power circuit, four-actuator/side confignration per this study for 
the booster and orbiler elevator. Curve B eliminates two actuators per side but re- 
tains the four power circuits. Switching valves are used to switch in .two standby 
power circuits. Curve C goes one step further and eliminates the two actuators /side 
and two power circuits. In this case each, pair of actuators has to provide 100% hinge 
moment. The tread shows that elinoinating power circuits is not effective , especially 
at the orbiter hinge moments , because the remaining two circuits must produce twice 
the oul^Jut required of each of the four circuits. 

8.1. 1.5 Redundancy vs. Weight - TVCl Following the same procedure as mentioned 
•in Section 8.1. 1.4, the .weights of all configurations could be reduced. In Configura- 
tion 3 for the booster TVC , the centering power circuit is also used in the servo 
channel to ensure that the system will fail to null at the first power circuit failure; 

Tills requires two hydraulic circuits for the configuration. If only one power circuit 
were used in the servo channels , the servoactuator could be centered by accumulator 
power. By eliminating one half of the tandem actuator and spool (add a switching 
valve) the total weight could be reduced 1256 lb from the 4157 lb tabulated in Section?. 
This arrangement is not as safe as Configuration 3 because centering capability is 
lost after ‘a failure combination of accumulator gas pressure and hydraulic circuit. 

If power actuator redimdancy is eliminated in the booster TVC configurations, the 
A weight decrease is as shown in Table 8-1. 

8,1.2 COMMONALITY. Configuration 1 for the orbiter and booster TVC was com- 
mon and operated oft vehicle API! systems. The results show that the booster TVC 
systems become heavy and quite complex in the servoactuator. The 22 actuator in- 
stallations should not be configured by orbiter requirements for the sake of common- 
ality alone. However, when power actuator redimdancy is reduced, the absolute 
weight penalty between Configurations 1 and 2 (least weight configuration) for the 
booster is 262 lb as shown above. Later studies will have to determine the allowable 
penalty to attain commonality. 
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Table 8-1. A Weight Decrease 


1 

Booster 

TVC 

Vehicle Weight (lb) 

Per This Study 

No Redundanc 5 '^ in 
Power Actuator 

A Weight 

Configuration 1 

3595 

*2979 

-616 

Configuration 2 

3135 • 

■ **2717 

-418 

Configuration 3 

4171 

***2915 

-1256 


^Delete one half of tandem actuator. .Add switcliing valve and incorporate 
centering provisions in power actuator. 


**Delete centering portion of power actuator. 

***r)eiete one half of tandem actuator and valve manifold, one engine 7 driven 
hydraulic circuit, and add switching valve and centering accumulator. 
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The electromechmiical velocity summing control is attractive because of the potential 
commonality on aerodynamic surface controls. It can be applied to sny application 
independent of the number of hydraulic power circuits used. The unit is essentially 
the same whether it controls two, three, or four hydraulic power circuits. Hydraulic 
control requires small hydraulic circuits for servo power, in addition to the circuits 
supplying output actuators if tlie control is more redundant than the output. 

8.1. 3 RELIABILITY AND XdAlNTAINABILITY . A review of reliability indicates 
that self-monitoring techniques offer a substantial gain in reliability. This reflects 
the paralleling effect that self-monitoring provides. It does not require cross con- 
nections or cross monitoring voting logic wliich tends to place all detection and switch- 
ing elements in series in a reliability model. This trend can be ‘seen by observing the 
relative reliability ranking of each Configuration 1 for aerodjniamic surface controls 
and TVC. Self monitoring is common to these configurations. 

In the orbiter aileron, Configuration 1 is two orders of magnitude better than Configura- 
tions. 2 and 3. This gain is due to hydraulic logic detection and switching (not depen- 
dent on electronic or electrical switching) as well as self monitoring. In this case 
self monitoring is accomplished by massive redundancy at the control level (six chan- 
nels). 

Another noticeable trend, however , is that maintainability is usually lower for self- 
monitox'ing schemes in terms of MFBMA. These results agree with the normal con- 
flict between reliability and maintainability; that is, when channel or system redundancy 
is used to increase reliability, maintainability suffers: 

8.1.4 AUTOMAHC VS. MANUAL SWITCHING. The force summing redundancy 
mechanization has the advantage over all other methods in that switching does not 
have to be immediate because the output of a bad channel is prevented from feeding 
through to the output. Thus a servoactuator (for aerodynamic surface controls) can 
be simplified (human factors permittting) by assigning the switching function to the 
crew. 

8. 1. 5 INTEGRATED HYDRAULICS. Integrated hydraulics (power and control by 
wire) was not considered in this study. A cursory look at sizes for the elevator of 
both vehicles indicated a proliibitive package size for installation. Once central 
hydraulic circuits were assumed, they were then available to supply, any load applica- 
tion. Installing integrated packages at low load applications would introduce small 
hydraulic power circuits in addition to the APU-driven central circuits causing an 
unnecessary complexity. Additionally, an integrated package would no doiJDt require 
cooling lines to route into the fuselage, thus hydraulic transmission could not be 
eliminated entirely. 
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8.2 RE COMMENDATIONS 


a. Hydraulic power and analog servoaotuators should be used throughout all flight 
control applications. 

b. Four hydraulic power circuits should be available and all four used on aero- 
djoiamic surface controls where they are competitive in weight. 

c. Power actuator and power circuit redundancy as defined by this study be 
retained on aerodynamic surface controls. 

Reasons: 1. Length of operating time/flight. 

2. Need to spread actuator reaction points on large single surfaces. 

3 . Number of power circuits required on board is- not solely a 
function of flight controls. (Utility functions will probably 
require a minimum of four circuits.) 

d. Power actuator redundancy should be reduced or eliminated on TVC and failure 
criteria applied to control channels only. 

Reasons: 1. Short operating time reduces probability of failure/flight. 

2. Save weight, 

3. Difficult actuator installation. 

e. Mechanical feedback be employed in TVC if possible to eliminate separate 
centering actuator (fail to null). 

f. Central APU-driven circuits be used for TVC if power actuator redundancy is 
eliminated and APU driven circuits are sized by aerodynamic surface controls; 

If TVC sizes the APU (not true based on requirements used in this study) 
additional study is required to determine impact on power source and power 
source fuel weight. (Aerodynamic surface controls operating at lower part 
load will increase fuel consumption. ) 

g. Obvious superiority of one control redundancy mechanization method could not 
be established. The many different teclmiques under development in the indus- 
try today indicate that no one solution has a clear advantage. Quite often a 
particular teclmique evolves as a result of special requirements. However, 
based on the requirements and findings of this study the following teclmiques 
are recommended as best candidates: 

1, Force summing control (self monitored) for aerodymamic surface controls 
[similar to Configuration 1 for the elevator]. 

Reasons: a) Nearly fully^ developed concept (SST). 

b) Provides protection against jams. 
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o) Has potential of pi'oviding control after tliree control 
failures, (e.g. , three channels may be able to provide 
two fail operate capabilities in a pure fly-by-wire system. ) 

d) Vei'satile: Switching can be manual. 

2. Electromechanical velocity summing for aerod 3 mamic surface controls 
[similar to Configuration 3 for the elevators]. 

Reason: Easier to achieve commonality for all load applications. Unit 

is functionally the same regai'dless of the number of hydraulic 
power circuits used. (Use is contingent on fabrication of 
' multiple tandem power spools. ) 

3. Active/standby control (self monitored) using secondary actuator for TVC 
[similar to Configuration 1, TVC, except secondary actuator, and mechan- 
iqal feedback from }power actuator added, and power actuator redundancj'' 
reduced] . 

Reasons: a) Common to orbiter and booster. 

b) Can use veliicle APU-dx’iven circuits (four per veMcle), 

c) Attains fail operate capability with only two hydraulic circuits. 

d) Redundancy level is consistent with available command chan- 
nels. Requires no voters or additional servoamplifiers. 

4. Monitorless "majority voting" for booster TVC only 
[similar to Configuration 2 for the booster TVC]. 

Reasons: a) Least weight. 

b) Fully developed concept. 

c) Least complex servoactuator. 

d) MonitoiTess arrangement more adaptable to booster than 
orbiter. (System checkout on the ground prior to flight, ) 

h. A single orbiter elevator paclmge be installed in the fuselage area if at all pos- 
sible. If elevator stiffness can be improved satisfactorily with a 250-lb A weight 
increase, no weight penally is involved and the servoactuator complexity, 
installation, and performance are vastlj'' improved. 

8.3 ENVELOPE SIZES 

Installation configurations were not possible at this time due to the preliminary state 
of vehicle design. To show some representative sizes-, reasonable geometric pro- 
portions were used based on very preliminary vehicle configuration data. Figures 
8-4 and 8-5 are examples of booster elevator and orbiter elevator envelope sizes 
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Figure 8-4. Envelope Sizes for Booster Elevator 
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PLAW VIEW- ELEVATOR. ORBITER 


Figure 8-5. Envelope Sizes for Orbiter Elevator 



I'espectively. These examples axe show'll only fox the sake of ball paxk estimating. 
To pursue this exei'cise further was not considered productive in that actual envelope 
sizing- requires more vehicle physical definition. One point is obvious from the 
figures: the installation designer will be hard pressed to install the three power 

circuit actuators in the available space. 
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